Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of a scheduled task using schtasks.exe that involves the string 'CrysomeLoader' in the command line, which is indicative of persistence or execution mechanisms associated with the CrysomeLoader malware.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects the creation of scheduled tasks using schtasks.exe where the command line includes indicators associated with potential malicious binaries or tools. Monitoring for these specific filenames in task creation can identify persistence mechanisms or authorized task scheduling abuse.
Detects instances where the FortiClient scheduler executable (scheduler.exe) spawns FortiTray.exe as a child process. While typically a legitimate operational behavior for the FortiClient application, this pattern is monitored to identify potential abuse where a trusted binary is leveraged as a proxy to execute secondary processes.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects the creation of a scheduled task via schtasks.exe identified by the specific command-line string associated with 'CrysomeLoader', configured to execute every 5 minutes.
Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
Detects the creation of scheduled tasks using the Windows schtasks utility, specifically looking for common adversarial naming conventions or patterns such as 'MiniJunk' or recursive task names, often used to establish persistence.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the command line contains the specific strings 'MiniJunk' or 'MiniBrowse'. This pattern is often associated with the installation or persistence mechanisms of specific malicious software.
Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
Detects a persistent loading pattern attributed to the Kimsuky threat group. The rule monitors for the creation of a hidden scheduled task named 'Edge Updater' that triggers a wscript.exe process executing a disguised VBScript file named with an 'OfficeUpdater' naming convention. This detection covers both the task registration (Event ID 4698) and the subsequent execution of the malicious script via wscript.exe.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
Detects instances where wermgr.exe, typically used for Windows Error Reporting (WER), spawns interactive command-line interfaces such as cmd.exe, powershell.exe, or others. This behavior is indicative of exploitation (such as CVE-2026-50656) where an attacker has redirected a scheduled task to execute malicious code under SYSTEM integrity, masquerading as the wermgr.exe process.
Identifies the loader cementing persistence by creating a scheduled task that executes the RMM payload upon user logon or system start. Specifically looks for 'schtasks.exe' creating a task with a name that is not alphanumeric and a task run command pointing to an executable in the AppData directory.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects unauthorized execution of wermgr.exe from suspicious paths or spawned by Task Scheduler service (svchost.exe/taskeng.exe) with non-standard parent processes. This behavior is indicative of privilege escalation attempts where an unprivileged process leverages the Windows Error Reporting (WER) QueueReporting scheduled task to execute a malicious payload in the context of the SYSTEM account.
This rule detects the creation of a scheduled task, either via schtasks.exe or Event ID 4698, where the task content points to a suspicious, user-writable directory (e.g., Temp, AppData). It correlates this activity with the presence of known Loader/Stealer process indicators (HijackLoader/Vidar) occurring within a 15-minute window on the same host, indicating likely persistence establishment by malicious software.
Page 23 of 58