Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,401
11,795
5,864
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects backup catalog deletions
Cisco File Deletion
Sigma
See what files are being deleted from flash file systems
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.
This rule detects the forced removal of legitimate cryptocurrency wallet applications (Ledger Wallet, Trezor Suite, Exodus) followed by the extraction of new applications into the /Applications directory on macOS. It also looks for chmod commands to make the new applications executable and attempts to download suspicious zip files from 'wusetail.com'. This activity is indicative of the AMOS malware campaign, which aims to replace legitimate wallet applications with trojanized versions to steal cryptocurrency.
This rule detects attempts to delete shadow copies using built-in Windows utilities such as PowerShell, WMIC, or VSSAdmin. The detection specifically looks for command-line arguments containing 'shadow' and 'delete' when executed by these processes. This activity is commonly associated with ransomware or other destructive malware aiming to prevent system recovery.
Detects execution of the builtin "del"/"erase" commands in order to delete files.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Detects the specific command line sequence used by Aura Stealer to terminate its process, overwrite its binary with zeros using fsutil, and delete the file to evade forensic recovery.
This rule detects the execution of IOBitUnlocker.exe with the '/delete' command-line argument. IOBitUnlocker is a legitimate tool that can be used to unlock and delete files that are otherwise in use or locked by the operating system. Adversaries may weaponize such legitimate tools to delete files, potentially for data destruction, indicator removal, or to hinder forensic analysis.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects when an AWS KMS key deletion is scheduled from a source that is not identified as an Infrastructure as Code (IaC) tool (e.g., CloudFormation or Terraform). This could indicate unauthorized attempts to destroy cryptographic keys, potentially leading to data unavailability or integrity issues.
Detects the self-deletion mechanism of the Interlock ransomware. The malware executes `rundll32.exe` to call a function within a randomly named DLL file with a `.wasd` extension, passing its own file path as an argument to be deleted.
Detects behaviors associated with the GRIDTIDE backdoor, including a specific self-deletion technique using 'ping 127.0.0.1 && del' and the creation of unique mutexes. These indicators are highly specific to the GRIDTIDE threat.
Page 29 of 36