Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects specific persistence artifacts associated with LARP53RAT, including unauthorized file shortcuts in the Startup folder, modifications to RunOnce registry keys for system recovery, and suspicious scheduled task creation masquerading as Microsoft Edge updates.
Detects execution of wermgr.exe from suspicious, non-standard directories (such as temp or user-writable paths). This behavior is indicative of the 'RoguePlanet' exploit, which leverages a junction swap to replace the legitimate Windows Error Reporting binary with a malicious payload, executed via the WER QueueReporting scheduled task.
Detects the creation of Windows scheduled tasks using 'schtasks.exe' where the executable being registered or the task itself is associated with suspicious directories like %LOCALAPPDATA%, %APPDATA%, or %TEMP%. The rule further filters for specific suspicious strings often used in malicious task configurations, indicating potential persistence or malicious command execution.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
This rule detects potential malicious scheduled task creation behavior linked to the Windows Package Manager (WinGet) and Desired State Configuration (DSC) components. It monitors for two primary indicators: first, the 'schtasks.exe' process being spawned by WinGet-related binaries (or via PowerShell in that context); second, Windows Event ID 4698 (a new scheduled task) where the task creation context involves WinGet binaries and specifies paths commonly used for temporary or user-writable locations (e.g., Temp, AppData). This is a common pattern for attackers to achieve persistence or execute payloads by masquerading through trusted package manager components.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
This rule detects persistence mechanisms associated with the SystemBC/Coroxy malware. It monitors for three indicators: 1) The creation of scheduled tasks via 'schtasks.exe' where the task binary is located in 'ProgramData' and uses the 'start' argument; 2) Windows Security Event ID 4698 (Scheduled Task Created) identifying similar task actions in 'ProgramData' with the 'start' argument; 3) The creation of Registry Run keys in 'HKCU' or 'HKLM' with values containing 'ProgramData' combined with malicious arguments such as 'start', '-windowstyle hidden', or '-ep bypass'.
Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) directly by known AI agent developer binaries (e.g., claude, cursor, aider) or indirectly via command shells spawned by these agents. This behavior may indicate an AI agent being leveraged to establish persistence or automate malicious actions on a host.
Detects persistence mechanisms frequently associated with SharkLoader and Cobalt Strike. The rule monitors for scheduled task creation using specific suspicious naming patterns, tasks pointing to SystemSettings.exe in non-standard directories (AppData/ProgramData), high-frequency task triggers, and registry run key modifications targeting SystemSettings.exe in similar suspicious paths.
Detects the creation of suspicious scheduled tasks by potentially malicious processes (e.g., winupdate.exe or processes running from AppData/.cache or Temp directories). The rule monitors for schtasks.exe usage that either targets specific persistence locations or creates tasks naming conventions (e.g., 'WindowsDefenderAgent') often associated with the Yuta/Glove Stealer malware family.
Detects malicious persistence mechanisms using the Windows Task Scheduler, specifically targeting the creation or execution of 'TPMProfiler' or 'qemu-system-x86_64.exe' under high-privilege accounts (SYSTEM). This rule monitors for schtasks.exe task creation, anomalous parent-child process relationships involving task host processes, and unauthorized module loads of taskschd.dll associated with QEMU activity.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects the creation of a scheduled task via schtasks.exe using parameters often associated with malicious persistence mechanisms, such as running as SYSTEM, requiring highest privileges, or placing task actions in directories like Temp, AppData, or Public. This behavior is consistent with tactics used by various threat actors, including UNC1549/MiniJunk, to maintain persistence.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
Detects the creation of scheduled tasks named 'MicrosoftEdgeUpdate' or 'MicrosoftEdge' that execute files located in non-standard directories such as ProgramData or Temp. This is a common technique used by threat actors to achieve persistence while masquerading as legitimate update services.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Page 24 of 58