SUSP_Scheduled_Task_Java_JAR_Aug25_RID333E

YARA detection rule by Florian Roth · CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/

Detects scheduled tasks that execute Java JAR files, which is suspicious but not necessarily malicious

rule SUSP_Scheduled_Task_Java_JAR_Aug25_RID333E : DEMO FILE SUSP T1053_005 {
   meta:
      description = "Detects scheduled tasks that execute Java JAR files, which is suspicious but not necessarily malicious"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2025-08-07 14:39:31"
      score = 60
      customer = "demo"
      license = "CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/"
      
      tags = "DEMO, FILE, SUSP, T1053_005"
      minimum_yara = "3.5.0"
      
   strings:
      $a0 = "<Task version=" wide
      $a1 = "xmlns=\"http://schemas.microsoft.com/windows/" wide
      $sa1 = "java.exe</Command>" wide
      $sa2 = "javaw.exe</Command>" wide
      $sb1 = "<Arguments>-jar " wide
   condition: 
      uint16 ( 0 ) == 0xfeff and filesize < 500KB and all of ( $a* ) and 1 of ( $sa* ) and 1 of ( $sb* )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b08f7dfd-76dc-4614-ac18-8ce5dba6d7c2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion