Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule identifies potential persistence activity on a Windows host by correlating multiple indicators such as service creation, scheduled tasks, registry run key modifications, Winlogon helper modifications, and driver loading. It specifically monitors for indicators associated with 'NetSupport' or 'client32' filenames or services. The rule triggers when two or more distinct persistence mechanisms are detected for the same host and user.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that involve indicators often associated with malicious behavior, such as targeting temporary or publicly writable directories ('appdata', 'temp', 'programdata') or employing suspicious command-line flags (e.g., encoded commands, highest privileges, or execution on system startup).
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698 that involve suspicious binaries (e.g., powershell, mshta), execution from user-writable directories, or tasks configured to run with SYSTEM privileges, which are common indicators of persistence establishment.
This rule monitors process creation events for suspicious activity, specifically detecting two patterns: 1) The creation of a scheduled task named 'OneDrive KeepAlive' using schtasks.exe, which is indicative of persistence mechanisms masquerading as legitimate software, and 2) Execution of the 'taskhostw.exe' binary with command-line arguments 'exec' and 'hide', which is a common indicator of the NirCmd utility being renamed and used for stealthy execution.
This rule detects potential persistence mechanisms and suspicious execution patterns associated with the ChainScript malware. It specifically monitors for the creation of scheduled tasks using PowerShell with indicators like 'StreamServiceSharedBridge.ps1' or 'ComponentTask33Agent', and the execution of VBScript-based agents via wscript.exe. It also flags tasks configured with specific execution time limits often associated with this malware's behavior.
This rule detects potential persistence mechanisms and suspicious execution patterns associated with the ChainScript malware. It specifically monitors for the creation of scheduled tasks using PowerShell with indicators like 'StreamServiceSharedBridge.ps1' or 'ComponentTask33Agent', and the execution of VBScript-based agents via wscript.exe. It also flags tasks configured with specific execution time limits often associated with this malware's behavior.
Detects DragonForce ransomware behavior where the binary is copied to a staging directory (typically C:\Users\Public\) and subsequently registered as a persistent, one-time execution scheduled task with SYSTEM privileges using COM interfaces or schtasks.exe.
Detects anomalous post-exploitation behaviors such as mass file modifications, lateral movement (SMB/RDP), or persistence mechanisms (scheduled tasks/services) following ScreenConnect client session activity. This behavior is indicative of potential exploitation of ScreenConnect to deploy ransomware or move laterally within the network.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
Detects signs of NetSupport Manager (client32.exe) establishing multiple persistence mechanisms simultaneously or in quick succession, including Windows service creation, Winlogon helper registration, Registry Run key modification, scheduled task creation, and keyboard filter driver installation. This behavior is indicative of unauthorized use of remote access tools to maintain persistence on a host.
Detects the execution of WScript via a scheduled task named 'MicrosoftEdgeUpdateTaskCore'. This pattern is often used to masquerade malicious activity by using the name of a legitimate Microsoft Edge update process to execute scripts silently (using //B //Nologo).
Detects the creation of a scheduled task named 'StandAloneOneDriveUpdater-2626' using either PowerShell or the schtasks utility. This naming pattern is often associated with malware attempting to persist on a system by masquerading as a legitimate OneDrive update process.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
Detects the creation of a scheduled task using 'schtasks.exe' configured to run as the SYSTEM account for a one-time execution. This behavior is often associated with persistence mechanisms or privilege escalation attempts where an adversary seeks to execute malicious code in a high-privileged context.
Detects the creation of a Windows scheduled task configured to execute as the SYSTEM account using a one-time execution trigger. This combination is frequently used by adversaries for post-exploitation activities, such as lateral movement or persistence, as it allows for a single, immediate execution of a malicious payload with high-level privileges.
Detects the use of administrative utilities 'wmic.exe' and 'schtasks.exe' to execute commands or create scheduled tasks on remote systems, excluding local execution scenarios.
Detects the creation of a scheduled task named 'OneDriveUpdateScheduler' or the execution of a related VBScript, which are commonly used by adversaries for persistence and code execution. This rule monitors process creation events for indicators of malicious task scheduling or script execution mimicking legitimate update processes.
This rule detects the creation of a scheduled task involving 'MicrosoftIME' or the placement of an 'MicrosoftIME.exe' file within the 'Microsoft\IME' directory. It correlates these activities to identify potential persistence mechanisms where an adversary may be attempting to hijack or masquerade as a legitimate Microsoft Input Method Editor process.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
Page 14 of 58