Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
753 detections
Filters
Last updated
All Time
Detection languages
360
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,443
11,831
5,872
5,155
4,866
753
Platforms
524
139
55
47
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
The detection targets these behaviours:
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
Detects a PHP FastCGI worker (such as php-cgi, php-fpm) spawning a PHP one-liner or shell interpreter executing code that writes, executes, and deletes a temporary PHP file. This pattern is characteristic of web shells or remote code execution exploitation.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects deletion of content within Zendesk. Removing attachments or tickets destroys
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects a single account deleting a large number of files on the NAS. On shared
storage this is either ransomware working through the share, a destructive insider,
or an attacker removing backups before encrypting the primary estate.
NAS appliances rarely carry endpoint agents, so their own logs are frequently the
only place this is visible.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED'
| duration 10m
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 50
storage this is either ransomware working through the share, a destructive insider,
or an attacker removing backups before encrypting the primary estate.
NAS appliances rarely carry endpoint agents, so their own logs are frequently the
only place this is visible.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED'
| duration 10m
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 50
Detects the Shai-Hulud supply chain attack dead-man's switch: a gh-token-monitor persistence component followed by a recursive forced deletion of the user home directory, or the presence of the specific kill-switch string in a command line.
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
Detects a shell command referencing a hidden, octal/self-deleting payload
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
The following analytic detects the deletion of the USN Journal using the fsutil.exe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because the USN Journal maintains a log of all changes made to files on the disk, and its deletion can be an indicator of an attempt to cover tracks or hinder forensic investigations. If confirmed malicious, this action could allow an attacker to obscure their activities, making it difficult to trace file modifications and potentially compromising incident response efforts.
Detects command-line activity on a NetScaler appliance indicative of defense evasion by truncating, deleting, or disabling audit logs (ns.log) and syslog forwarding services. This activity often follows the exploitation of public-facing application vulnerabilities where an attacker seeks to hide their presence.
Detects the deletion of volume shadow copies using common Windows administrative tools such as vssadmin, wmic, and PowerShell. This activity is frequently observed during the pre-encryption stage of ransomware attacks to prevent system restoration.
Detects a service principal or application identity performing a burst of deletion operations across multiple Azure resource types, such as Storage Accounts, SQL Databases, Key Vaults, and Function Apps. This behavior is indicative of malicious activity, including potential cloud environment destruction or 'agentic' destructive operations similar to those observed in the Storm-3168 (JADEPUFFER) threat activity.
Detects two distinct suspicious patterns: first, the deletion of executable files residing in common user-writable temporary directories (e.g., Temp, Downloads, AppData) using command-line tools like 'del' or 'erase', which is often indicative of anti-forensic activity after malware execution. Second, it monitors for network traffic involving HTTP POST requests or specific SOAP headers related to 'tempuri.org', which are commonly associated with default .NET WCF service scaffolding and may be used by adversaries for C2 communication or exfiltration.
Page 1 of 36