Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule detects the creation of scheduled tasks using 'schtasks.exe' or Windows Security Event ID 4698, specifically looking for tasks configured to run with 'HighestAvailable' privileges or tasks that execute suspicious script files (sys.vbs, Thal.exe, wscript.exe, cscript.exe). This behavior can indicate an adversary establishing persistence or escalating privileges.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects potential persistence attempts on Windows systems where an unsigned executable, located in a user-writable directory (Temp, AppData, Downloads), is either configured for automatic startup via Registry run keys or registered as a scheduled task.
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
Identifies the execution of a process with 'VirtualSmokestGuy666' in its command line, which is indicative of CastleRAT Build 666 establishing persistence. This specific string suggests a scheduled task or similar mechanism used by the malware to maintain its presence on the system.
Detects potential persistence mechanisms associated with SharkLoader or similar malware campaigns. The rule monitors for unauthorized modification of Windows Run registry keys by non-Microsoft signed processes, the creation of suspicious scheduled tasks masquerading as legitimate update tasks (e.g., OneDrive or Microsoft updates), and the execution of processes from common malware working directories like 'AppData/Roaming/xwreg' or 'AppData/Roaming/xgdf'.
Detects the creation of a scheduled task named 'RageGuard' or containing 'RageGuard' in its command line, often associated with TrymeLocker malware. The rule monitors for Task Scheduler Event IDs 4698 and 106, as well as schtasks process command line arguments used to create such tasks.
Detects the creation or modification of scheduled tasks that either utilize user-writable directories (e.g., AppData, Temp) for task execution or mimic the naming convention of 'OneDrive Standalone Update' tasks. This behavior is indicative of persistence mechanisms used by the StrikeShark campaign to deploy SharkLoader and related payloads, such as Cobalt Strike.
Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects the unauthorized deletion of cmd.exe from System32 or SysWOW64 by a non-system process, correlated with the creation of a new service or scheduled task on the same host within 60 seconds, which is characteristic of TrymeLocker malware persistence and tampering.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Identifies the creation or execution of a scheduled task named 'GoogleErrorReport', which is used by the threat group Dropping Elephant (also known as Patchwork or FIN13) to run their side-loading chain every minute. This rule detects both the command-line invocation of schtasks.exe to create or modify tasks and the Windows Security Event ID 4698 for scheduled task creation, specifically looking for the 'GoogleErrorReport' string.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
Correlates the fake VPN installer creating a scheduled task pointing to the high-entropy AppData directory to ensure the stealer runs on boot.
Detects the creation of scheduled tasks using 'schtasks.exe' with names that mimic legitimate Microsoft services such as 'RealtekAudio', 'CoreUIComponents', 'OneDriveHealthTask', or 'WindowsUpdate'. This technique is often used by adversaries for persistence.
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Detects the creation of scheduled tasks that masquerade as legitimate update processes (e.g., Microsoft Edge, Google Updater) using elevated privileges (/rl highest) and triggering on system logon (/sc onlogon). The rule specifically flags tasks associated with suspicious paths or binary names like VMWare or PerfWatson to identify potential persistence or execution mechanisms.
Detects the execution of a scheduled task named OneDriveHealth invoking taskkill on explorer.exe to trigger a hijacked COM object. This rule specifically looks for 'svchost.exe' as the initiating process, executing 'taskkill' with 'explorer.exe' in its command line, which is indicative of a specific attack chain involving scheduled tasks and process termination.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Page 36 of 58