// Detection

Persistence mechanism created

A scheduled task, service or run key established on a host, giving an intruder a way back after reboot.

HighInvestigating0alerts raisedSignature

Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where eventType is PERSISTENCE_CREATED

{
  "kind": "match",
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "PERSISTENCE_CREATED"
    }
  ]
}

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

NameSeverity

Description

CategoryATT&CK tacticTechnique

Logic

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

What this rule has actually caught.

Armed, but nothing in the retained window has matched it.