Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
This rule detects HTTP responses (status code 200) that contain the string 'schtasks' followed by '/run' and '/tn' (case-insensitive) in the response body. This pattern indicates the potential for a client system to receive instructions to execute a scheduled task, which could be used for persistence, lateral movement, or other malicious activities.
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
CyberSecurityNews has reported a raising case about a new wave of phishing emails masquerading as breach notifications from LastPass.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
This rule detects the execution of scheduled tasks that launch specific, potentially suspicious, Living Off The Land Binaries (LOLBINs) or other uncommon programs. The detection focuses on programs like calc.exe, cscript.exe, mshta.exe, mspaint.exe, notepad.exe, regsvr32.exe, and wscript.exe when they are initiated by the Task Scheduler. The intent is to identify potentially malicious activity where adversaries might use scheduled tasks for persistence, execution, or privilege escalation by leveraging legitimate system utilities in an unusual context.
Detects the loading of the "taskschd.dll" module from a process that is located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application has the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determine if it is malicious.
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
This rule detects persistence mechanisms used by the Kapeka backdoor. It specifically looks for the creation of a scheduled task named "Sens Api" (or "OneDrive" in some cases) via `schtasks.exe` set to run on system startup, or the addition of an autorun registry entry named "Sens Api" under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` via `reg.exe`. Both persistence methods are identified by their command lines calling `rundll32` with a `.wll` file and the export ordinal `#1`.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
Detects the creation of scheduled tasks with specific names ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in March 2018.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME
Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.
This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a '
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Detects post-exploitation execution technique of the Serpent backdoor. This involves creating a temporary scheduled task using an unusual method: creating a fictitious Windows event and a trigger that executes a payload once the event is created. The detection specifically looks for command-line arguments indicative of this behavior when executed by cmd.exe or powershell.exe.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write. This rule specifically looks for the execution of 'schtasks.exe' with command-line arguments indicative of modifying an existing scheduled task's properties, such as changing the user account and password, which could be abused in privilege escalation scenarios.
Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.
Detects scheduled task creation using the 'schtasks' utility that incorporates suspicious or uncommon command-line patterns. This includes tasks scheduled to run frequently (e.g., every minute) or as the 'system' user, combined with common command interpreters ('cmd'), or containing keywords often associated with malicious activity like PowerShell download commands, obfuscation techniques, or execution from temporary/public user directories. It also flags the use of scripting engines (cscript, wscript) or curl within scheduled tasks.
Page 46 of 58