Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects a pattern where a process enumerates running processes via tasklist looking for msedge.exe with SHELL32.dll or CoreUIComponents.dll modules loaded, followed within 5 minutes by a taskkill /F /PID command against that process, initiated by svchost.exe, taskeng.exe, python.exe, pythonw.exe, powershell.exe, or a process invoked via native_host.py. This behavior matches Edgecution's technique of detecting a running headless Edge instance and terminating it before relaunching, as observed in the UNC6692 campaign.
Detects the execution of Microsoft Edge (msedge.exe) with suspicious command-line arguments designed to sideload malicious browser extensions, often associated with the UNC6692 campaign. The rule specifically looks for a combination of flags including --load-extension, headless/no-startup-window modes, known malicious or suspicious paths (e.g., 'User Data\test1'), and the disabling of browser synchronization or the first-run experience, occasionally triggered by scheduled tasks.
Detects the creation of a scheduled task named 'WindowsUpdate' or 'BootUpdate' that triggers the execution of 'fsociety.exe' with SYSTEM privileges. This pattern is indicative of the TOKYOCORE malware establishing persistence on a Windows host.
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
KQL Query from file: CornFlake RAT dropper file creation at %APPDATA%\svchost32\svchost32.exe
Detects scheduled task creation or execution masquerading as GoogleUpdateService or MSEdgeUpdateService with a GUID suffix, combined with anomalous payload indicators such as csvchost.exe, psvchost.exe, App.py, python-3.13.13-embed-amd64.zip, or WakeToRun=$true, associated with the DOUBLECUP loader delivering the DeviceManager RAT.
Detects the MSEdgeUpdateService<GUID> fallback scheduled task that runs a patched conhost.exe (csvchost.exe) headless launch or patched PowerShell (psvchost.exe) to re-fetch CountLoader from C2 every 25 minutes.
Detects the creation of scheduled tasks using schtasks.exe where the initiating process is unsigned or the target binary path is located in common user-writable or temporary directories, a technique frequently used by malware for persistence.
Detects self-deleting process artifacts or deletion of a scheduled task named MicroUpdaterV1 shortly after its creation, indicative of loader cleanup behavior used by DOUBLECUP-related payloads.
Detects schtasks.exe being used to create a new scheduled task that points to an updater/downloader binary located under %APPDATA% or %LOCALAPPDATA%, consistent with SilentMare's persistence mechanism established by its installer to run the updater once per day.
Detects the creation of a suspicious scheduled task via schtasks.exe that masquerades as Windows Update or BootUpdate. The task is configured to execute 'fsociety.exe' with SYSTEM privileges upon system startup, logon, or boot, a behavior consistent with TOKYOCORE ransomware persistence and lateral movement.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects remote scheduled task creation, execution, or deletion via schtasks.exe with a suspicious task action.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility, where the parent process is a Windows script host ('wscript.exe' or 'cscript.exe'). This is a common technique used by malware for persistence.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects creation of a hidden scheduled task disguised as a legitimate software update, a persistence technique used by ACR Stealer's Campaign 1 installer stage. The malware extracts payloads into deceptive AppData directories such as LogiOptionsPlus and registers a scheduled task to relaunch a pythonw.exe-based Python loader at user sign-in.
Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.
Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.
Detects the creation of scheduled tasks using specific, suspicious task names associated with the CURP threat campaign. This rule monitors for 'schtasks.exe' command line executions involving the creation of tasks with names 'brokerhost' or 'net_queue_32', which are identified as indicators of persistent threat activity.
Page 21 of 58