Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of a scheduled task via the Windows COM interface, a technique used by malware like SynkLoader to bypass command-line monitoring (e.g., schtasks.exe). The rule monitors Windows Security Event IDs 4698 and 4702 for tasks configured to trigger on logon that execute script-based content (Python or PowerShell) from user-writable directories.
Detects GhostTask-style hidden scheduled task persistence associated with the TWINLOOT Python implant framework. Legitimate scheduled tasks always write a security descriptor (SD) value under HKLM\...\Schedule\TaskCache\Tasks\<GUID>\SD alongside the corresponding HKLM\...\Schedule\TaskCache\Tree\<TaskName> entry. GhostTask abuses RegLoadAppKey/offreg.dll to build the TaskCache structure offline, producing a Tree entry and a Tasks\<GUID> key WITHOUT the accompanying SD value. The absence of the SD value combined with presence of the Tree entry is the key differentiator from normal task creation, which always writes SD. This technique is used by TWINLOOT to establish persistence while evading standard registry-event-based detections that rely on the presence of an SD value.
Detects the TWINLOOT Python implant's self-update mechanism, in which a schtasks.exe process is spawned with '/Run' by a pythonw.exe parent process while referencing a reobf.json manifest on the command line, indicating the implant is relaunching itself via a scheduled task after fetching an updated/reobfuscated payload configuration.
This rule detects the creation of a Windows scheduled task named 'TaskHandler' using the schtasks.exe utility. The task is configured to execute a specific file, 'F7u00ex.exe', on system startup under the 'NT AUTHORITY\SYSTEM' account. This behavior is indicative of a persistence mechanism, often associated with the Spark RAT malware, which attempts to maintain a foothold on the system with high-level privileges.
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Detects the creation of a scheduled task using the schtasks.exe utility designed to run with SYSTEM privileges upon system startup. This behavior is often associated with persistence mechanisms where an adversary attempts to maintain long-term access by ensuring malicious code executes automatically with high privileges whenever the system boots.
Detects scheduled-task persistence launching masqueraded defender.exe/Sang.exe with SYSTEM privileges at startup, outside legitimate Windows Defender/Sangfor install paths.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
Detects a security-software presence check (360 Total Security/eScan process names) followed within 10 minutes by a persistence-establishing event from the same parent process.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
Detects process self-deletion (executable, scheduled task, or install directory) correlated within 60 minutes to a matching prior creation event, indicating post-execution cleanup behavior consistent with loader/RAT install-then-delete patterns such as those used by DOUBLECUP-delivered payloads.
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Detects the creation of a scheduled task named 'MicroUpdaterV1' using the 'schtasks.exe' utility with an XML configuration file ('t.xml') that specifies 'pythonw.exe' as the task target. This behavior is associated with the persistence mechanism of the DeviceManager RAT as delivered by the DOUBLECUP loader.
Detects the creation of scheduled tasks using specific naming patterns (GoogleUpdateService or MSEdgeUpdateService followed by a GUID) often associated with the CountLoader malware. This technique attempts to masquerade as legitimate Google or Microsoft Edge update processes to establish persistence.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects recreation of svchost32/Cloud Sync Service persistence (registry Run key, Windows service, or scheduled task) within 15 minutes of removal, indicative of CornFlake backdoor re-installation following remediation.
Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.
Detects redundant persistence mechanisms associated with the CornFlake RAT by identifying the creation of Windows services, registry run keys, and scheduled tasks that reference a binary named svchost32.exe located outside of the standard C:\Windows\System32 directory, often masquerading as a 'Cloud Sync Service'.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Detects the creation of scheduled tasks using names specifically identified in the Larva-24009 (HeptaX) campaign. These task names spoof legitimate Intel and Google Update tasks to establish persistence for a PowerShell-based backdoor, allowing the attacker to evade detection by mimicking common software update processes.
Page 20 of 58