Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,216 detections
Filters
Last updated
All Time
Detection languages
512
326
77
74
65
Contributors
296
180
163
99
82
Categories
879
794
434
154
126
Platforms
1,200
18
13
7
6
Products / Services
443
331
276
231
118
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,216
CVEs
4
2
1
1
1
IDS Classtypes
13
5
1
1
IDS Protocols
15
4
1
The following analytic detects the execution of CompatTelRunner.exe with parameters indicative of a process not part of the normal "Microsoft Compatibility Appraiser" telemetry collection. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line arguments. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
This analytic detects when the Windows Task Scheduler service (svchost.exe -k netsvcs -p -s Schedule) spawns common command-line interpreters or scripting engines such as powershell.exe, cmd.exe, wscript.exe, or cscript.exe. This activity is significant because attackers frequently abuse the Task Scheduler for execution and persistence, attempting to blend in with legitimate Windows operations. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment.
This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
The following analytic detects the creation of a new scheduled task using Schtasks.exe to run as the SYSTEM user. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it often indicates an attempt to gain elevated privileges or maintain persistence within the environment. If confirmed malicious, an attacker could execute code with SYSTEM-level privileges, potentially leading to data theft, ransomware deployment, or further system compromise. Immediate investigation and mitigation are crucial to prevent further damage.
The following analytic detects the use of 'schtasks.exe' to schedule forced system reboots using the 'shutdown' and '/create' flags. It leverages endpoint process data to identify instances where these specific command-line arguments are used. This activity is significant because it may indicate an adversary attempting to disrupt operations or force a reboot to execute further malicious actions. If confirmed malicious, this could lead to system downtime, potential data loss, and provide an attacker with an opportunity to execute additional payloads or evade detection.
This analytic detects instances where the `taskschd.dll` is loaded by processes running in suspicious or writable directories. This activity is unusual, as legitimate processes that load `taskschd.dll` typically reside in protected system locations. Malware or threat actors may attempt to load this DLL from writable or non-standard directories to manipulate the Task Scheduler and execute malicious tasks. By identifying processes that load `taskschd.dll` in these unsafe locations, this detection helps security analysts flag potentially malicious activity and investigate further to prevent unauthorized system modifications.
The analytic detects the use of 'schtasks.exe' to start a Scheduled Task on a remote endpoint. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process details such as process name, parent process, and command-line executions. This activity is significant as adversaries often abuse Task Scheduler for lateral movement and remote code execution. If confirmed malicious, this behavior could allow attackers to execute arbitrary code remotely, potentially leading to further compromise of the network.
The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. This behavior is identified by analyzing Windows Security Event Logs. Such activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts.
The analytic detects the execution of a Windows Scheduled Task on demand via the shell or command line. It leverages process-related data, including process name, parent process, and command-line executions, sourced from endpoint logs. The detection focuses on 'schtasks.exe' with an associated 'run' command. This activity is significant as adversaries often use it to force the execution of their created Scheduled Tasks for persistent access or lateral movement within a compromised machine. If confirmed malicious, this could allow attackers to maintain persistence or move laterally within the network, potentially leading to further compromise.
Detects the creation of a scheduled task that runs weekly and executes the "shutdown /l /f" command. This behavior has been observed being used by KamiKakaBot samples to achieve persistence on a system.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
This rule detects the creation, modification, or deletion of scheduled tasks using specific task names known to be associated with the SVR-attributed GraphicalProton backdoor. The task names are designed to mimic legitimate Windows services to evade detection.
Detects the execution of specific processes and command line combinations associated with the Forest Blizzard APT group. This includes the creation and deletion of scheduled tasks using 'schtasks.exe' and PowerShell commands for file operations, as described by Microsoft.
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
Detects the execution of SharpMove, a .NET utility used for lateral movement that performs tasks such as task creation, Service Control Manager (SCM) queries, and VBScript execution via WMI. The detection is based on the executable name or original filename and the presence of specific command-line arguments indicating its functionality.
Detects the creation of a scheduled task in the Windows Registry that is specifically associated with the Diamond Sleet APT group. This activity is linked to their exploitation of the TeamCity CVE-2023-42793 vulnerability, where they create a scheduled task named 'Windows TeamCity Settings User Interface' to establish persistence or execute malicious code.
Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.
Detects when adversaries delete important scheduled tasks related to system restore, Windows Defender, BitLocker, Windows Backup, Windows Update, Update Orchestrator, or Exploit Guard. This activity could indicate an attempt to disrupt system services or processes, potentially as a precursor to data destructive activities or to hinder defensive capabilities.
Page 57 of 58