Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
Detects the creation of scheduled tasks using schtasks.exe where the task involves paths often associated with user-writable directories (ProgramData, AppData, Temp) and specific suspicious keywords. This behavior is common for adversaries seeking persistence by scheduling execution of potentially malicious payloads located in non-standard or user-writable locations.
Detects the creation of a scheduled task named 'RageGuard' using the Windows schtasks.exe utility. This behavior is indicative of the TrymeLocker malware attempting to maintain persistence on a compromised system by executing with highest privileges upon user logon.
RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Detects the creation of a scheduled task named 'WindowsUpdateTempFileCleanUp' or suspicious scheduled task naming conventions associated with the BeepRAT malware. The rule specifically monitors for the execution of a TCC loader chain, often masquerading or leveraging configurations located within the %LOCALAPPDATA%\TCC directory to maintain persistence with high privileges.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects the creation of scheduled tasks using the Windows schtasks utility where the task action points to a file located in common user-writable directories such as AppData, Temp, Users\Public, or Downloads. This behavior is frequently associated with persistence mechanisms used by malware and backdoors.
Modular remote access trojan associated with long-term espionage intrusions
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Modular remote access trojan associated with long-term espionage intrusions
Photo-themed ZIP phishing campaign dropping a Node.js implant
Cloud extortion group exploiting exposed credentials and storage
Banking trojan and loader using malicious Office macro delivery
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Detects the creation of scheduled tasks using schtasks.exe where the command originates from or references the C:\ProgramData\ directory. This pattern is consistent with the SystemBC (Coroxy) malware's persistence mechanism, where a randomly named executable is staged in ProgramData and configured for execution via Task Scheduler.
Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.
Detects persistence mechanisms associated with Obsidian Sandstorm activity, including scheduled task creation, registry run key modification, and startup folder file drops initiated by suspicious processes or from non-standard directories like AppData/Temp.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) that include command-line arguments referencing virtualization artifacts (qemu, .qcow2, .vmdk, TPMProfiler) or specific database/dll files (vault.db, bisrv.dll). This pattern is often indicative of persistence mechanisms used by malware or threat actors to manage virtualized environments, exfiltrate data, or deploy components.
Detects suspicious activities related to the execution of qemu-system-x86_64, including scheduled task creation referencing 'TPMProfiler', execution under the SYSTEM account, and outbound network communication to known malicious IP addresses on specific ports (22, 32567, 22022).
Page 26 of 58