Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation or modification of scheduled tasks using the 'schtasks.exe' utility, specifically looking for indicators associated with persistence mechanisms such as task names or commands like 'StandAloneOneDriveUpdater-2626' and 'Automata-20.exe'.
This rule detects potentially malicious command patterns involving PowerShell and the Windows Task Scheduler. It identifies suspicious uses of Microsoft Edge update task names, PowerShell commands executing encoded scripts, and specific external download patterns associated with potential dropper or downloader activity.
Detects the establishment of persistence by the RUSTYMOVE malware through the creation of a scheduled task via PowerShell. The rule specifically looks for a command line containing both 'Register-ScheduledTask' and the specific masqueraded name 'StandAloneOneDriveUpdater-2626', which mimics a legitimate OneDrive update process.
Detects malicious scheduled task creation using names intended to mimic Microsoft Edge update tasks. The rule identifies suspicious process activity including the spawning of conhost.exe with headless flags, PowerShell commands with encoded arguments, and attempts to fetch external scripts from the known malicious typosquatted domain indiatodays.org, all of which are characteristic of APT36 (Transparent Tribe) activity.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
This rule detects the creation of a scheduled task intended to run an executable named 'wsc_updata.exe' from a temporary directory, or identifies svchost.exe initiating a process from that location. Such behavior is indicative of potential persistence mechanisms where malicious actors attempt to run code from unauthorized or writable directories under the context of system processes or scheduled tasks.
Detects the use of the Windows schtasks utility to delete a scheduled task named 'Windows Update'. This pattern is associated with OpnKey ransomware, which attempts to remove legitimate or potentially competing tasks to maintain persistence or avoid detection.
This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.
This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.
Detects the creation or modification of a scheduled task named 'Maps Performance Task' using schtasks.exe or reg.exe. This task is often associated with legitimate Windows system maintenance related to map data but may be monitored as it involves persistence mechanisms.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
Detects execution of PowerShell commands containing suspicious arguments (e.g., encoded commands, download cradles) initiated by scheduled task binaries (svchost.exe, taskeng.exe, schtasks.exe) or involving specific suspicious strings associated with identified threat activity.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that reference suspicious paths (AppData/Local or Roaming) or specific executables often associated with suspicious activity (Launcher.exe, GapiUpdate.exe) in conjunction with 'DeviceSetupManager'. Additionally, it includes a hash-based detection for a specific known malicious file artifact.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that reference suspicious paths (AppData/Local or Roaming) or specific executables often associated with suspicious activity (Launcher.exe, GapiUpdate.exe) in conjunction with 'DeviceSetupManager'. Additionally, it includes a hash-based detection for a specific known malicious file artifact.
This rule detects the creation of a scheduled task intended to run an executable named 'wsc_updata.exe' from a temporary directory, or identifies svchost.exe initiating a process from that location. Such behavior is indicative of potential persistence mechanisms where malicious actors attempt to run code from unauthorized or writable directories under the context of system processes or scheduled tasks.
This rule detects the creation of a scheduled task intended to run an executable named 'wsc_updata.exe' from a temporary directory, or identifies svchost.exe initiating a process from that location. Such behavior is indicative of potential persistence mechanisms where malicious actors attempt to run code from unauthorized or writable directories under the context of system processes or scheduled tasks.
Detects instances where a process named firefox.exe, executing from the ProgramData directory, is used to establish persistence via Windows Registry Run keys or to create scheduled tasks/services. This behavior is indicative of a malicious process masquerading as the legitimate Firefox browser to maintain persistence on a host.
Detects the creation of a scheduled task named 'Google Chrome Update' using the Windows schtasks.exe utility. The rule flags instances where the task is created from locations other than the legitimate Google Chrome installation directories, identifying potential persistence mechanisms masquerading as a common software update process.
This rule detects the creation of scheduled tasks that attempt to masquerade as legitimate Google Chrome Update tasks. It flags tasks that use the 'Google Chrome Update' name but do not follow the standard naming convention (which typically includes 'GoogleUpdateTaskMachine') or tasks that initiate suspicious actions using scripting engines (like PowerShell, cmd.exe, mshta, etc.) rather than the signed Google update binary.
Detects instances where a process named firefox.exe attempts to establish persistence via Windows Registry Run keys or Windows Task Scheduler while operating outside of standard Mozilla Firefox installation directories. This behavior is indicative of masquerading techniques used by threats such as BabylonRAT to maintain persistence under the guise of a common web browser.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
Page 16 of 58