Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of a scheduled task named 'XenoUpdateManager' using 'schtasks.exe', which is associated with the Operation XENOFISCAL campaign and the SideCopy threat group. The rule also surfaces the parent process that initiated the scheduled task creation.
Detects the creation of the WindowsVaultSyncService scheduled task or a task using the specific misleading description observed in SHEETCREEP (APT36) infections. The malware uses the Task Scheduler COM API to establish persistence.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines contain 'OneDrive Update' along with scheduled task registration utilities like 'Register-ScheduledTask', 'New-ScheduledTask', or 'schtasks'.
This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.
This rule detects potential lateral movement activities by monitoring for the execution of 'psexec', 'wmiexec', or 'schtasks' commands within a short timeframe on the same computer. A count of 2 or more such command executions within an hour is flagged as suspicious, indicating potential adversary activity.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects the creation of a scheduled task intended to execute a VBScript (.vbs). This technique is notably used by a North Korean-linked npm infostealer RAT to establish login persistence via a hidden VBS launcher.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects execution and persistence mechanisms associated with the
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects attempts to modify the Zoom update scheduled task using `schtasks.exe /change`. This activity is indicative of potential scheduled task hijacking, as legitimate Zoom updaters typically do not use this command to modify their own tasks. The detection specifically looks for command lines containing both `/change` and `ZoomUpdateTaskUser-`.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects the execution of an Alternate Data Stream (ADS) payload located in the %TEMP% directory via wscript.exe, a critical persistence mechanism used by Gamaredon's GammaLoad.
Remote AT Scheduled Job Creation
Suricata
This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.
Detects the creation of scheduled tasks originating from processes executing out of temporary or download directories. This behavior aligns with the persistence mechanisms of the SilverGorilla .NET dropper, which is typically delivered via recruitment-themed phishing archives.
Page 39 of 58