Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,401
11,795
5,864
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects the Python wrapper and native dropper deleting their own unicode.py and terminate.dll components after the payload has been unpacked. The rule specifically looks for file deletion events where the target file name matches 'unicode.py' or 'terminate.dll' within common application data directories (site-packages, dist-packages, AppData, Temp) and the command line contains deletion-related keywords.
Identifies the execution of the ClientDelete command designed to wipe traces of the Realtek-disguised malware from the disk. Specifically, it looks for 'cmd.exe' executing a 'del' command with 'RealtekAudio' in the path, which is a known pattern for AsyncRAT self-deletion.
Captures the self-deletion execution phase corresponding to Opcode 0x1B removing the implant from the host disk. This rule specifically looks for 'setup.exe' deleting itself.
Detects the SMBExec lateral movement pattern where a command is echoed to a temporary .bat file and then immediately deleted. This technique often involves using `cmd.exe` to write and execute commands on a remote system via administrative shares.
Detects the payload cleaning up its tracks by recursively deleting the .laravel_locale temporary artifacts directory after exfiltration.
Detects self-deletion commands (e.g., rm -f $0) used by Miasma payloads to remove their execution tracks from disk immediately after running. The rule specifically looks for process command lines containing 'rm', '-f', and either '$0' or '%~dp0', which are common patterns for self-deletion in shell scripts.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects bulk file deletion indicating a data destruction attack
This rule detects when a single process account initiates the deletion of 10 or more executable (.exe), dynamic link library (.dll), or system (.sys) files within a 5-minute window on a device. This behavior can be indicative of malicious activity such as malware cleanup, anti-forensics, or an attempt to disrupt system functionality.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects bulk file deletion indicating a data destruction attack
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects node.exe deleting a 24-character hexadecimal JavaScript file from the Temp directory after execution, which is indicative of the Mastra NPM supply chain attack.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects when multiple versions of files are deleted within SharePoint by a single user. This could indicate an attempt to remove historical data or cover tracks.
Detects instances where an executable is deleted immediately after execution, a common defense evasion technique used by memory-resident malware like the JDY botnet. This rule specifically looks for shell processes executing 'chmod +x' or 'chmod 777' followed by 'rm' commands, often chained with '&&', ';', or '||', indicating immediate self-deletion after execution.
Detects clearing of Linux system log files to remove forensic evidence
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion, often used by malware to remove its traces.
Detects the specific command-line sequence utilized by the SHEETCREEP dropper to delete itself (melt) and hide forensic traces using cmd.exe. This involves a delayed deletion using 'choice' and 'del /f /q' commands.
This rule detects a high volume of TCP traffic on port 445 (SMB) directed to the home network, specifically looking for the SMB protocol signature. The threshold of 500 connections within 30 seconds from a single source IP suggests an attempt at mass file deletion or disk wiping activity on network shares, often associated with ransomware or destructive malware.
Page 27 of 36