Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
753 detections
Filters
Last updated
All Time
Detection languages
360
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,443
11,831
5,872
5,155
4,866
753
Platforms
524
139
55
47
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
This rule detects potential anti-forensic activity on Citrix ADC/NetScaler devices by monitoring for two primary indicators of log tampering: an unexpected drop in syslog volume to zero following a period of activity, or the execution of explicit commands intended to clear audit logs and configuration files.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
Detects a suspicious volume of cloud resource deletions occurring within a short 15-minute window, specifically targeting multiple storage accounts and SQL database/server instances. This behavior is indicative of a malicious actor or an automated script attempting to disrupt business operations or destroy data.
Detects the specific command-line sequence used by SectopRAT for self-deletion. The malware uses 'choice' to create a delay followed by a 'del' command to remove its own executable, a technique for deleting files after the process has terminated.
Detects a burst of file delete or overwrite operations initiated by a configured AI agent service identity. This behavior, if deviating from established baselines, may indicate a compromised agent performing malicious destructive activities such as mass data deletion or ransomware-style file destruction.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Detects unauthorized file deletion activity performed directly by a Node.js process acting as a ChainScript RAT. The RAT uses a bundled node.exe process, operating within specific masquerading directories in the user profile, to execute file system operations such as recursive deletion without spawning child processes.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects high-velocity, automated-paced burst of deletion operations spanning multiple distinct Azure resource types (Storage, SQL, Key Vault, Web Sites) within a 15-minute window. This behavior is indicative of agentic AI-orchestrated cloud resource destruction, contrasting with typical administrative lifecycle management.
Detects the use of legitimate Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to prevent automatic system recovery. This behavior is a common indicator of ransomware preparing for encryption by removing local recovery options.
Detects anomalous bursts of deletion activity targeting Azure Site Recovery and Backup resources, including management locks and backup policies. This behavior is consistent with an adversary attempting to inhibit system recovery capabilities, often a precursor to destructive activities such as ransomware deployment. The rule also correlates this activity with the deletion of other critical infrastructure components like databases or storage accounts.
Detects attempts to delete Azure resource locks protecting Site Recovery or Backup services, followed by credential retrieval (ListKeys) within a one-hour window. This sequence pattern is a strong indicator of an adversary attempting to disable backup protection before potentially destroying data or exfiltrating keys.
Detects the execution of the DEL command via cmd.exe spawned by sqlservr.exe, specifically targeting batch scripts, executables, or text files located within AppData or ServiceProfiles paths. This behavior is indicative of post-exploitation activity where an attacker removes staging artifacts used during lateral movement or persistence phases to hide their tracks after using xp_cmdshell.
Detects two distinct suspicious patterns: first, the deletion of executable files residing in common user-writable temporary directories (e.g., Temp, Downloads, AppData) using command-line tools like 'del' or 'erase', which is often indicative of anti-forensic activity after malware execution. Second, it monitors for network traffic involving HTTP POST requests or specific SOAP headers related to 'tempuri.org', which are commonly associated with default .NET WCF service scaffolding and may be used by adversaries for C2 communication or exfiltration.
Detects two distinct suspicious patterns: first, the deletion of executable files residing in common user-writable temporary directories (e.g., Temp, Downloads, AppData) using command-line tools like 'del' or 'erase', which is often indicative of anti-forensic activity after malware execution. Second, it monitors for network traffic involving HTTP POST requests or specific SOAP headers related to 'tempuri.org', which are commonly associated with default .NET WCF service scaffolding and may be used by adversaries for C2 communication or exfiltration.
Detects anomalous file manipulation behavior consistent with the Kothamine agent, characterized by rapid create, write, and delete cycles on a single file. The detection specifically targets processes identified as either explorer.exe with a reflected Kothamine DLL module or the standalone MicrosoftEdgeUpdateCore.exe loader running from an AppData staging path.
Detects anomalous file manipulation behavior consistent with the Kothamine agent, characterized by rapid create, write, and delete cycles on a single file. The detection specifically targets processes identified as either explorer.exe with a reflected Kothamine DLL module or the standalone MicrosoftEdgeUpdateCore.exe loader running from an AppData staging path.
Detects attempts to clear or delete Windows Event Logs using common utilities like wevtutil.exe, PowerShell cmdlets, or direct file system deletion of .evtx files.
Page 2 of 36