Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,401
11,795
5,864
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects the use of legitimate Windows system utilities (vssadmin, wmic, bcdedit, wbadmin) to disable recovery mechanisms, such as deleting shadow copies or modifying boot configuration. This behavior is commonly associated with ransomware attempting to prevent system restoration.
Detects execution of cmd.exe with specific command-line arguments consistent with the Pay2Key ransomware SFX dropper cleanup routine. The pattern involves using ping for a loopback wait followed by fsutil or specific del commands to delete the dropper executable.
Detects a suspicious command line pattern where the Windows command shell (cmd.exe) is utilized to trigger a time-delayed deletion of the process image PerfWatson2.exe. This behavior is indicative of an attempt to remove indicators of compromise or cleanup malicious artifacts after execution.
This rule detects the use of the Windows command shell (cmd.exe) executing a specific pattern involving the 'choice', '/T', and 'del' commands. This sequence is often used as a technique to delay execution or wait for a process to terminate before deleting it, a common tactic for self-deleting malware, scripts, or malicious tools aiming to evade forensic analysis.
Detects the Kazuar malware removing job instructions and result files from its working directory after exfiltration or task completion. This rule specifically looks for file deletion events (EventCode 23 or 26 in Sysmon) where the file path matches patterns indicative of task, job, result, output, or stage files with common extensions like json, dat, bin, txt, or zip.
Correlates the creation and immediate deletion of the trin.tar.gz archive handled by the Python temporary-directory context manager.
Detects the self-deletion behavior of the Prinz Eugen ransomware. The ransomware, identified by the filename 'servertool.exe', spawns a command shell to execute a ping command (as a delay mechanism) followed by a force-deletion command to remove itself from the disk after encryption activities are complete.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
Detects StealC's characteristic self-deletion pattern where cmd.exe executes a timeout delay followed by a forced quiet file deletion (/f /q) of the malware binary. This occurs as StealC's final operation after data exfiltration when the self_delete flag is set in the C2 configuration.
Detects a batch script attempting to delete itself using the 'del %~f0' command. This technique is often used by malicious scripts to remove forensic evidence after execution.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
This rule correlates the successful loading of the 'EEDbg.sys' driver with subsequent command-line activity indicating an attempt to stop a service or delete the 'EEDbg.sys' file. This behavior is indicative of an attacker cleaning up forensic evidence after a Bring Your Own Vulnerable Driver (BYOVD) attack, specifically targeting the EnCase EDR's driver.
Detects the threat actor clearing the staging archives securely via sdelete or forcefully via del /f /q immediately post-exfiltration. This rule correlates process execution of 'cmd.exe' or 'sdelete.exe' with specific command-line arguments targeting archive files (zip, rar, 7z) and a preceding network connection to a remote IP, indicating potential data exfiltration followed by anti-forensic cleanup.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects the Vidar cleanup phase where it spawns a ping delay loop followed by self-deletion (del) of the AutoIt executable using cmd.exe.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.
This rule detects attempts to clean up artifacts associated with the Amos Stealer by monitoring for the deletion of known staging paths. Specifically, it looks for the execution of 'rm' commands targeting '/tmp/osalogging.zip' or '/tmp/sync'. This activity suggests an adversary is trying to remove traces of their presence after data exfiltration or staging.
Page 26 of 36