Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.
Detects the creation of a scheduled task via schtasks.exe that involves PowerShell executing commands via IEX and IRM, a technique associated with the DeepLoad malware to maintain persistence.
Detects the creation of a Windows Scheduled Task with command line arguments indicative of the Potemkin Loader, which uses task scheduling to maintain persistence by executing an RMM payload located in the AppData directory upon system startup or user logon.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
Detects the creation of a scheduled task involving QEMU binaries or associated configuration files, correlated with registry modifications that reference similar artifacts. This pattern is indicative of potential malicious use of virtualization tools for persistence, execution, or environment cloaking.
Detects the creation of scheduled tasks with suspicious task names (e.g., masquerading as Microsoft UI components) or payloads (e.g., Python interpreters or .cat files) set to execute every minute. This behavior is associated with the persistence mechanism of the NarwhalRAT malware used by the APT37 threat group.
Detects various post-exploitation activities associated with the Amadey loader, including the execution of its persistence mechanism (nudwee.exe), dropping and executing secondary payloads in temporary directories, using PowerShell download cradles, creating scheduled tasks for persistence, and silent MSI installations. This rule aims to identify the delivery of secondary payloads like StealC and Lumma Stealer.
Detects the creation of scheduled tasks or command-line execution of task scheduling utilities (schtasks.exe, at.exe) that reference known SharkLoader persistence paths, file names, or task naming conventions.
Detects the creation of suspicious scheduled tasks associated with TrymeLocker ransomware. The rule monitors for tasks named 'RageGuard' or 'win_guard', as well as tasks registered with high privileges using non-standard file paths such as AppData, Temp, or ProgramData, triggered by system logon or startup.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
This rule detects the creation and execution of scheduled tasks used by StrikeShark's SharkLoader, often associated with Cobalt Strike, for persistence. It identifies suspicious scheduled task names that mimic legitimate Microsoft services (e.g., OneDrive, MicrosoftUpdate) and the execution of 'SystemSettings.exe' from unusual 'AppData' subdirectories ('xwreg' or 'xgdf'). The rule has three branches: detecting 'schtasks.exe' command-line usage to create such tasks, detecting 'ScheduledTaskCreated' events with the suspicious names or command patterns, and detecting 'SystemSettings.exe' execution from the specific 'AppData' subdirectories.
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
Detects persistence mechanisms associated with ModeloRAT, specifically monitoring for suspicious Registry Run key entries, scheduled tasks, and startup folder items that execute 'pythonw.exe' or 'WPy64-31401' based binaries.
This rule monitors for persistence mechanisms being established on Windows systems. Specifically, it tracks unauthorized modifications to the HKEY_CURRENT_USER Run registry key using 'reg.exe', the creation of scheduled tasks using 'schtasks.exe', and suspicious process spawning patterns where 'MpExtMs.exe' executes 'reg.exe' or 'schtasks.exe' to facilitate persistence.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an `AppData` directory.
Page 31 of 58