ATT&CK T1485 - SMB Mass File Delete Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects a pattern of mass file deletion over SMB (Server Message Block) protocol. It triggers an alert if 100 or more SMB packets containing specific content (likely indicating file operations) are observed within a 10-second window, originating from the same source IP address and destined for port 445 (SMB). This behavior is often associated with ransomware or other malicious activities aiming to impact data availability.