Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule detects activity associated with BRUSHWORM/BRUSHLOGGER malware. It looks for network connections to the domain 'dawnnewsisl.com' with a URL path containing '/updtdll'. Additionally, it checks for process execution from a specific path pattern (e.g., '\ProgramData\Photoes\Pics\*.exe') or 'rundll32.exe' executing 'C:\Users\Public\Libraries\Recorder.dll'. The combination of these indicators aims to identify high-confidence BRUSHWORM/BRUSHLOGGER activity.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects scheduled task creation with naming patterns matching APT36 CreepDropper persistence mechanism
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects the creation of a scheduled task using 'schtasks.exe' with specific command-line arguments that indicate an attempt to establish persistence. The rule looks for 'schtasks.exe' creating a task named 'Runtime Broker' that executes a program from a suspicious path within 'C:\ProgramData\Microsoft\Windows\Runtime\'. This pattern is often used by adversaries to maintain access to a system.
Detects the creation of a specific scheduled task used by Interlock ransomware to execute its payload with SYSTEM privileges.
Detects the creation of a scheduled task named 'Runtime Broker' that executes files from 'C:\ProgramData\Microsoft\Windows\Runtime\'. This technique is used by the Slopoly malware, deployed by the Hive0163 group, to establish persistence by masquerading as a legitimate Windows service.
Detects the creation of a scheduled task named 'TaskSystem' with SYSTEM privileges, a specific behavior of the Interlock ransomware.
This rule detects the creation of scheduled tasks with names specifically identified in the Bitdefender APT36 Vibeware report. These task names are used by APT36 to maintain persistence for their malware, often disguised as legitimate system processes.
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
This detection rule identifies a persistence mechanism observed in the Dead#Vax campaign. It detects the Windows Script Host (wscript.exe) being launched by the Task Scheduler engine (taskeng.exe or svchost.exe) to execute a VBScript from a suspicious, user-writable directory such as AppData or a specific ProgramData path like 'ProgramData\IntelDriver'. This behavior is indicative of malicious persistence.
Detects the creation or modification of scheduled tasks using 'schtasks.exe' where the task is configured to run under 'NT AUTHORITY\SYSTEM' or 'NT AUTHORITY\NETWORK SERVICE' (represented as 'SYSTEM' or 'NT AUT' in the command line), but the initiating process is not a standard system process. This can indicate an attempt to establish persistence or elevate privileges.
This rule detects artifacts associated with the APT36 CreepDropper malware, specifically focusing on scheduled task names and staging file markers. It looks for specific strings related to scheduled tasks like 'MicrosoftEdgesUpdatesTasksMachineUAs-Task' and 'MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy', as well as a staging file named 'ds.png' and other related strings such as 'msedge.exe', 'Task10', and 'System.Reflection.Assembly'. The rule requires at least four of these strings to be present, along with the MZ header, indicating a Windows executable.
Detects the creation of scheduled tasks with specific names and command-line patterns associated with the BadPaw PowerShell backdoor. This technique is used by the threat actor to establish persistence on the compromised system.
Detects the creation of a scheduled task designed to execute a VBScript from a temporary or user-specific directory. This technique is used by the Dead#Vax malware to establish persistence with a layer of indirection, avoiding direct PowerShell execution from the task itself.
This rule detects the creation of scheduled tasks with specific names identified in the Bitdefender APT36 Vibeware report. These task names are associated with APT36's persistence mechanisms, used to maintain malware execution, launch hidden components, and continue operations after initial infection. The rule specifically targets these known malicious task names rather than broadly detecting all scheduled task creations, aiming to provide high-fidelity alerts indicative of APT36 activity.
Detects the execution of a scheduled task characteristic of the GhostWeaver RAT. The malware's persistence mechanism involves a hidden task that executes PowerShell via 'conhost --headless' and often uses a task name that mimics legitimate PowerShell cmdlets to blend in.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
This rule detects the creation of a scheduled task named "WSPrint" that executes "C:\ProgramData\WSPrint\WSPrint.exe" at system startup. This specific pattern of `schtasks.exe` usage, including the task name and program path, is associated with persistence mechanisms described in the Cisco Talos UAT-9244 report.
Page 42 of 58