Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of scheduled tasks using schtasks.exe with suspicious command-line patterns, specifically those containing encoded commands or specific strings related to Windows system components (WindowsColorSystem, Calibration). This technique is often used by adversaries to establish persistence or facilitate execution of malicious payloads.
Detects the creation of scheduled tasks using specific Mozilla-related naming patterns ('\Mozilla\UpdateTask' or '\Mozilla\ElevateTask') that execute with SYSTEM privileges, a behavior associated with Payouts King ransomware persistence mechanisms.
Detects the creation of suspicious scheduled tasks used by the StrikeShark campaign for persistence. These tasks are named with a prefix mimicking OneDrive updates ('OneDrive Standalone Update Task-S-1-') and are configured to execute SystemSettings.exe from specific AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates process execution logs and scheduled task creation events to identify the dropper activity.
Identifies the creation of a scheduled task using 'schtasks.exe' where the initiating process is a Bomgar executable (bomgar-rep.exe or bomgar-scc.exe). This behavior is indicative of an attacker establishing persistence after exploiting a Bomgar vulnerability.
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
Detects the creation of a specific scheduled task named 'WindowsSecurityUpdate' using 'schtasks.exe' in conjunction with network communication to 'azurewebsites.net'. This activity is indicative of the MiniUpdate malware, associated with the Iranian APT group 'Screening Serpens', attempting to establish persistent access.
Identifies the creation of scheduled tasks for Windows System Health Monitor persistence, specifically looking for 'schtasks.exe' creating tasks with names like 'Windows System Health Monitor' or 'Windows System Health Check', in conjunction with 'RuntimeHost.exe' activity. This pattern is indicative of cryptojacking campaigns abusing ScreenConnect.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
Detects persistence mechanisms associated with 'Operation Poisson', specifically focusing on the creation of a scheduled task named 'TaskAdmin1' with highest privileges that launches 'wscript.exe' with 'sys.vbs' at logon, or the use of Registry Run keys to achieve similar persistence with 'sys.vbs'. It also detects the execution of 'wscript.exe' with 'sys.vbs'.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Detects scheduled tasks named "CheckRealtekAudioVersion" or "RealtekAudioEnhancements64" created for AsyncRAT persistence. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' argument and the presence of these specific task names in the command line, which are known indicators of AsyncRAT establishing persistence.
Detects the creation of both 'UpdateSystem' and 'UpdateUser' scheduled tasks on the same device within a ten-minute window, a distinctive persistence pattern associated with the Gentlemen Ransomware.
Identifies the creation of scheduled tasks masquerading as Realtek audio services for persistence, often associated with AsyncRAT.
Detects manual or programmatic triggering of the Windows Error Reporting 'QueueReporting' scheduled task. The RoguePlanet exploit abuses this task to execute an overwritten wermgr.exe binary as SYSTEM. This rule identifies execution via 'schtasks.exe /run' command line or via COM API calls reflected in Task Scheduler Operational logs.
Detects schtasks creating a one-time task on another host using supplied credentials and a batch file under Windows Temp, executed as SYSTEM. This behavior is indicative of an adversary establishing persistence or lateral movement by scheduling malicious code to run with high privileges on a remote system.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
Identifies the creation of the BackupCheck scheduled task designed to repeatedly trigger the setup.exe doit sideload chain, associated with the Nimbus Manticore threat actor.
Detects the creation of a scheduled task using 'schtasks' with 'SYSTEM' privileges, masquerading as Adobe or OneDrive, and pointing to an executable in a user-writable path (Temp, AppData, ProgramData, or Users\Public). This pattern is often used by adversaries for persistence or privilege escalation.
This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.
Page 37 of 58