Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of scheduled tasks using schtasks.exe with command-line arguments that contain suspicious file names, paths, or flags often associated with malicious behavior, such as persistence mechanisms or potential lateral movement tools.
Detects the creation of scheduled tasks using 'schtasks.exe' with command-line arguments containing specific patterns such as 'WindowsUpdateTempFileCleanUp', 'config.ini.c', 'SchTask_x86', or 'SchTask_x64'. These patterns are often associated with the deployment of malicious persistence mechanisms or software execution.
Detects evidence of SystemBC (Coroxy) malware persistence, characterized by the creation of a scheduled task using 'schtasks.exe' that executes a random binary residing in '%ProgramData%' with a 'start' argument, coupled with concurrent modifications to the Windows 'Run' registry keys in a persistent path.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
Detects persistence mechanisms associated with the SHARDLOADER malware family, including the creation of suspicious scheduled tasks and modification of registry run keys. The rule monitors processes, scheduled task events, and registry value changes for specific indicators such as paths in C:\ProgramData\IDM\logs\, files named 'pcl2bmp' or 'mediuminststart', and DLL sideloading patterns involving SolidPDFCreator.
Detects a batch or script artifact that creates a scheduled task named 'ApphostRagistreationVerifier' (a likely typo for 'ApphostRegistrationVerifier') which is configured to execute a file located within the 'Windows\Fonts\' directory. The detection specifically looks for the presence of 'schtasks' command, 'ONSTART' trigger, and 'SYSTEM' user context, indicating a persistent scheduled task.
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
Detects the creation of a scheduled task by the Potemkin Loader using the 'schtasks.exe' utility. The rule specifically looks for command lines containing task creation flags combined with an executable path located within 'AppData' directories, which is a common persistence mechanism for this loader.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
Detects the creation of a scheduled task using 'schtasks.exe' with specific command-line arguments that indicate an attempt to establish persistence. The rule looks for 'schtasks.exe' creating a task named 'Runtime Broker' that executes a program from a suspicious path within 'C:\ProgramData\Microsoft\Windows\Runtime\'. This pattern is often used by adversaries to maintain access to a system.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects the creation of scheduled tasks from XML files in 'C:\Users\Public\Documents\' by 'schtasks.exe' and subsequent execution of JavaScript payloads via 'wscript.exe' or 'cscript.exe' from the same public documents directory. This activity is attributed to the CryptoBandits threat group.
Page 35 of 58