Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,401
11,795
5,864
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
This rule detects attempts to delete files or directories using the 'rm -rf' command within a web request URI. This often indicates an attacker attempting to clean up traces of their activity or cause denial of service by removing critical files on a compromised web server.
This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
MySQL Database DROP TABLE Attack
Suricata
This rule detects attempts to drop tables in a MySQL database. It specifically looks for the 'DROP TABLE' string in TCP traffic directed to the standard MySQL port (3306) on the home network. This activity is often indicative of malicious intent, such as data destruction or database tampering.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
This rule detects a pattern of mass file deletion over SMB (Server Message Block) protocol. It triggers an alert if 100 or more SMB packets containing specific content (likely indicating file operations) are observed within a 10-second window, originating from the same source IP address and destined for port 445 (SMB). This behavior is often associated with ransomware or other malicious activities aiming to impact data availability.
Detects the arbitrary deletion of the critical WordPress configuration file (wp-config.php), which is a known impact of PHP object injection attacks (e.g., CVE-2025-7384) aiming to cause a denial of service.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
Detects the destructive command line used by the Miasma campaign's dead man's switch to wipe the user's home directory upon token revocation. Specifically looks for 'rm -rf ~/; rm -rf ~/Documents' executed by 'rm' or 'rm.exe'.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
Nginx or Crash Log Deletion
Cortex XDR
Detects command-line activity indicating the deletion of crash core dump files or Nginx logs. This behavior was observed by CL-STA-1132 as a defense evasion technique to cover tracks after exploiting CVE-2026-0300.
Detects destructive Linux commands such as recursive root directory deletion (rm -rf /*) and random data disk wiping (dd if=/dev/urandom of=/dev/sdX). This behavior has been observed as payloads in indirect prompt injections targeting LLM agents to destroy host filesystems.
Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.
Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
This rule detects attempts to clear or truncate journal logs on Linux systems. Adversaries may clear logs to remove evidence of their activities.
Detect changes in auditd configuration files
Page 28 of 36