Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of scheduled tasks using schtasks.exe with suspicious command line parameters or originating from unusual parent processes. This includes tasks created to run as SYSTEM, tasks configured with ONSTART triggers, tasks referencing common temporary directories, or tasks created by processes typically unrelated to scheduled task management (e.g., Teams, remote assistance tools, or command processors).
Detects activity associated with the Payouts King ransomware, including identified malicious binary hashes, the creation of Mozilla-themed scheduled tasks for persistence, and execution via command line to elevate tasks to SYSTEM privilege.
Detects the creation of scheduled tasks using schtasks.exe where the command points to payloads residing in user-writable directories such as AppData or Temp. This behavior is indicative of TA4922 malware (e.g., Atlas RAT or RomulusLoader) establishing persistence. The rule excludes common installers and trusted publishers to reduce false positives.
Detects the creation of scheduled tasks that contain indicators related to QEMU virtualization software (e.g., binaries, disk images) or tasks created by web server processes. This behavior is often associated with adversary attempts to establish persistence, hide malicious activity within VM environments, or execute payloads following exploitation of a web application.
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
This rule detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious filenames or paths, specifically focusing on components associated with QEMU, database files, or known suspicious executables. It further highlights tasks created with high-privilege context (SYSTEM or highest integrity level) or those configured to trigger on system-level events (logon, start, idle), which are common indicators of persistence mechanisms used by attackers.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is often associated with remote management or administrative tasks, but can be leveraged by adversaries to establish persistence or remote execution.
Detects instances where ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe are observed spawning schtasks.exe, powershell.exe, or pwsh.exe with command line arguments indicative of creating or registering a scheduled task. This behavior is highly irregular for these system binaries and may indicate an adversary attempting to achieve persistence by masquerading or exploiting legitimate Windows management components.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Detects the execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is indicative of persistent scheduled task creation being orchestrated through the abuse of WinGet Desired State Configuration (DSC) resource management capabilities.
Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.
Detects the Amadey loader malware attempting to establish persistence via Windows Scheduled Tasks. The rule monitors for the execution of schtasks.exe with parameters creating a task that points to suspicious user-writable directories (Temp, AppData) or known Amadey-related artifacts such as the 'e079729711' staging path or 'nudwee.exe' binary.
Page 33 of 58