Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
The rule detects the execution of 'run.exe' where its image path contains 'SoftwareProtectionPlatform' and its command line arguments include both 'SoftwareProtectionPlatform' and 'udp.pyw'. This specific combination is indicative of the KongTuke malware establishing persistence through a scheduled task named 'SoftwareProtection'.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The malware drops its components into a subfolder of AppData to masquerade as a legitimate platform component.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This is a persistence mechanism used by the CrashFix campaign to masquerade as a legitimate Windows service.
Detects the creation of a scheduled task named "TPMProfiler" that executes QEMU ('qemu-system-x86_64.exe'). This technique was observed being used by threat actors to establish persistence after exploiting SolarWinds Web Help Desk vulnerabilities.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Detects the creation of a scheduled task named 'SoftwareProtection' used by the CrashFix campaign to execute a renamed Python interpreter for persistence.
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation. The rule identifies both the execution of QEMU with SSH port forwarding command-line arguments and the creation of the malicious scheduled task.
Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.
This rule detects the creation of scheduled tasks on remote systems using the 'schtasks.exe' utility. Specifically, it looks for instances where a scheduled task is created with high-privilege accounts such as 'Administrator', 'SYSTEM', or 'NT AUTHORITY'. The detection logic requires the presence of '/create', '/s' (specifying a remote system), '/tr' (task run), '/tn' (task name), and '/ru' (run as user) flags in the command line. It explicitly filters out tasks created on the local machine (localhost, 127.0.0.1, ::1). This activity is indicative of potential lateral movement or privilege escalation, as adversaries often use remote scheduled tasks to establish persistence or execute commands on other systems within a network with elevated privileges.
This rule detects the creation of scheduled tasks using the `schtasks.exe` utility with specific parameters indicating elevated privileges. Specifically, it looks for tasks created with the `/create` command, running under the `SYSTEM` user account (`/ru SYSTEM`), and with the highest privilege level (`/rl HIGHEST`). This combination of parameters is often leveraged by adversaries for defense evasion, persistence, and privilege escalation by ensuring the scheduled task executes with maximum system privileges.
This rule detects the creation of a process that involves 'qemu' in its image path and contains 'hostfwd=tcp' along with either 'vault.db' or 'bisrv.dll' in its command line. This combination is indicative of an SSH backdoor deployment, specifically observed in the context of SolarWinds Web Help Desk exploitation where threat actors establish persistence using a scheduled task named TPMProfiler to execute QEMU with an SSH port forward.
This rule detects the creation of a scheduled task with 'TPMProfiler' in its command line. This specific task name has been observed in malicious contexts related to SolarWinds Web Help Desk exploitation, typically used for persistence to run QEMU for an SSH backdoor. While legitimate TPM-related tasks exist, the 'TPMProfiler' name in this context is indicative of compromise.
Detects persistence mechanisms used by the OtterCookie malware, part of the Lazarus "Contagious Interview" campaign. It specifically looks for the creation of a 'NodeHelper' registry run key and a 'NodeUpdate' scheduled task.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects creation of a scheduled task named Microsoft\Windows\Defrag\CorelDefrag configured to execute an obfuscated PowerShell payload on a daily basis. This task mimics a legitimate Windows Defrag task to maintain persistence.
Detects persistence mechanisms used by the Interlock RAT, which leverages specific, deceptive scheduled task names related to Defrag, Chkdsk, and TimeSync to maintain a foothold on compromised systems.
Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.
Detects the creation of scheduled tasks used for persistence by fake PDF converter malware. These tasks are created in the registry under the TaskCache tree.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
Detects the creation of scheduled tasks with specific names and command lines used by the TamperedChef malware for persistence.
Page 44 of 58