Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
Detects the creation of a scheduled task named '\MicrosoftSystem64', which is a specific Indicator of Compromise (IoC) associated with the Windows variant of the FAMOUS CHOLLIMA / MicrosoftSystem64 RAT malware for persistence. The rule identifies this activity through Windows Event Log (Event ID 4698 for task creation), command-line execution of 'schtasks.exe' with '/create' and the specific task name, and Defender EDR telemetry for scheduled task creation.
Detects suspicious scheduled task creation using schtasks.exe with XML task imports from user-writable directories such as AppData\Local. This behavior is associated with malware families like JustAskJacky, which establish persistence by creating GUID-named scheduled tasks that execute malicious payloads such as node.exe and obfuscated JavaScript files.
Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects various activities associated with the Nimbus Manticore implant, including its process execution with a specific argument, the creation of a scheduled task for persistence, and the staging of malicious files in a specific AppData directory. It looks for the execution of 'setup.exe' with 'doit' argument, the creation of a scheduled task containing 'BackupCheck', and the creation of specific files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' folder.
Detects the creation of scheduled tasks using an XML file located in a temporary directory, a technique used by DesckVB for stealthy persistence.
This rule detects the creation of a scheduled task named 'MicrosoftSystem64' using various methods. It looks for command-line execution of 'schtasks.exe /create' with the specific task name, explicit ScheduledTaskCreated events from Microsoft Defender for Endpoint (MDE) containing 'MicrosoftSystem64', and Windows Security Event ID 4698 (Scheduled Task Created) where the TaskName contains 'MicrosoftSystem64'. This specific task name is associated with known threat actor activity, particularly FAMOUS CHOLLIMA / DPRK-linked actors deploying Node.js SEA RAT.
Identifies the creation, execution, or deletion of specific scheduled tasks ('\Mozilla\ElevateTask' or '\Mozilla\UpdateTask') used by Payouts King ransomware for persistence and SYSTEM elevation.
Detects the creation of a scheduled task named 'Microsoft Display Manager' using schtasks.exe. This specific task name is associated with the BoldTealLayer malware loader, which uses this persistence mechanism when running with administrative privileges.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects the creation of scheduled tasks that explicitly call mshta.exe, matching the persistence mechanism of the CountLoader payload launcher.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects the creation of a specific scheduled task (TempLogA) used by ModeloRAT to establish persistence and maintain SYSTEM-level access on compromised hosts. The rule looks for `schtasks.exe` execution with `/create`, `TempLogA`, and `SYSTEM` in the command line.
Detects the creation of scheduled tasks named 'ChromeCheck' or 'EdgeCheck' that execute regsvr32.exe. This behavior is associated with Kimsuky's MemLoad loader, which establishes persistence to deploy the httpTroy backdoor.
Detects the creation of a specific scheduled task (TempLogA) used by ModeloRAT to establish persistence and maintain SYSTEM-level access on compromised hosts. The rule looks for `schtasks.exe` execution with `/create`, `TempLogA`, and `SYSTEM` in the command line.
Detects the creation of a SYSTEM-level scheduled task using 'schtasks.exe' that launches 'pythonw.exe' with 'Pmanager.py'. This activity is indicative of the KongTuke threat actor establishing persistence for ModeloRAT, ensuring long-term access to the compromised system.
Phantom Bot Task Persistence
Cortex XDR
Detects the creation of a scheduled task named 'SystemUpdate' calling the node executable, an indicator of the 'axois-utils' phantom bot persistence. This rule specifically looks for `schtasks.exe` being used with `/create`, `SystemUpdate`, and `node` in the command line.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Page 40 of 58