Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    All Authors
    SB

    Saksham Bhattarai

    First rule: Wed Nov 04 2026 00:00:00 GMT+0000 (Coordinated Universal Time)
    Share profile card
    1rules authored
    0sole author
    1co-authored
    Top Log Sources
    1
    windows / image_load
    1 rules
    Rule Types
    detection
    1
    By Severity
    critical
    0
    high
    0
    medium
    1
    low
    0
    informational
    0
    By Status
    stable
    0
    test
    0
    experimental
    1
    deprecated
    0
    unsupported
    0
    1
    Total Rules
    0
    Stable Rules
    0
    High / Critical
    1
    Log Source Types
    Recent RulesAll rules →
    1 rulesInspect a rule without leaving your results.
    mediumexperimentalDetection

    Microsoft Office Application Loading Task Scheduler DLL

    Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks. This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled malicious documents attempting to establish persistence.

    windowsimage_load2 samples
    2026-11-04
    Browse all 1 rules by Saksham Bhattarai
    Filter the full rule library to see only their contributions
    View Rules →