Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services. This rule specifically looks for the creation of scheduled tasks via 'schtasks.exe /create' command line that include task names such as 'Synchronize OS', 'Windows System Health', 'BackupCheck', or 'WindowsSecurityUpdate', which are commonly used by adversaries to blend in with legitimate system tasks.
Detects creation of persistence tasks executing XML payloads.
Detection of scheduled tasks like DiskDiagnosticDataCollector created by GammaWorm to launch ADS payloads.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Mail Task Masquerade
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Correlates the MiniJunk V2 persistence task with the execution of the renamed SoftwareLicencing.exe. This rule detects the creation of a scheduled task named "Synchronize OS" via schtasks.exe, and then correlates it with the execution of a file named "SoftwareLicencing.exe" on the same device. This behavior is indicative of the MiniJunk V2 malware used by the Screening Serpens APT group.
Identifies the creation or execution of a 'VirtualSmokestGuy' scheduled task, which is associated with CastleRAT for persistence. The rule specifically looks for command-line activity containing 'VirtualSmokestGuy' and excludes specific numerical strings to reduce false positives.
Identifies schtasks.exe creating persistence mechanisms configured with both logon and startup triggers simultaneously, a signature of the CheckRealtekAudioVersion task.
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services (e.g., Synchronize OS, Windows System Health, BackupCheck, WindowsSecurityUpdate).
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Udm Mail Task Masquerade
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Detects the creation of specific scheduled tasks known to be used by ScarCruft (APT37) to establish persistence for NarwhalRAT. The rule looks for scheduled task creation events (EventID 4698 in SecurityEvent logs or ActionType 'ScheduledTaskCreated' in DeviceEvents) where the task name matches known malicious task names used by ScarCruft, specifically 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine'.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
Detects if schtasks is modifying an existing XenoUpdateManager task, indicating payload updating, as observed in Operation XENOFISCAL.
This rule detects the creation or modification of a Windows scheduled task that includes 'deno' in its command line. This activity is suspicious as it can indicate malware establishing persistence on a system, especially on typical office PCs where Deno is not commonly used. Further investigation is recommended to determine if the activity is legitimate or malicious.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python payload, indicative of ModeloRAT persistence.
Detects the creation of a scheduled task named 'AlphaSecurity' using schtasks.exe with the '/create' command-line argument. This specific task name and creation method have been associated with the Broomstick backdoor, which is used by the Rhysida ransomware group for persistence.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Page 38 of 58