Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
161 detections
Filters
Last updated
All Time
Detection languages
65
58
15
6
5
Contributors
28
20
17
16
15
Categories
77
71
56
22
14
Platforms
139
24
5
4
4
Products / Services
31
30
26
20
12
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
'The query detects a scheduled task, created/updated remotely, using the Schtasks process.
Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network.
Ref: https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html'
Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network.
Ref: https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html'
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_schtask_creation.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
'This query detects lateral movement using GPO scheduled task usually used to deploy ransomware at scale.
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
This query looks for signs of impacket atexec module. Should work with others using similar technique.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-3/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-3/
Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
Looks for rare process launch as a scheduled task and activity done by the processes.
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Find attempts to stop System Restore and.
Prevent the system from creating restore points.
Prevent the system from creating restore points.
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
Detects various execution patterns of the CrackMapExec pentesting framework
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
Detects various execution patterns of the CrackMapExec pentesting framework
Detects the creation of tasks from processes executed from suspicious locations
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1069 (also known as BearLPE), the second vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1069 (also known as BearLPE), the second vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
This rule detects remote RPC calls specifically targeting the Task Scheduler service (SASec) to read information about scheduled tasks. This activity is often associated with reconnaissance by adversaries attempting to understand the environment's scheduled jobs.
The following analytic detects the creation of a new DWORD value named "EnableAt" in the registry path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration". This modification enables the use of the at.exe or wmi Win32_ScheduledJob commands to add scheduled tasks on a Windows endpoint. The detection leverages registry event data from the Endpoint datamodel. This activity is significant because it may indicate that an attacker is enabling the ability to schedule tasks, potentially to execute malicious code at specific times or intervals. If confirmed malicious, this could allow persistent code execution on the system.
Page 7 of 8