Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,401
11,795
5,864
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects the deletion of Internet Information Services (IIS) WebServer access logs, which could indicate an adversary attempting to remove forensic evidence of their activities on a compromised web server. The rule specifically looks for delete events targeting files within the common IIS log directory structure (`\inetpub\logs\LogFiles\`) with a `.log` extension.
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
This hunting query detects adversaries attempting to impair or disable power-related functions in Windows environments. It covers explicit powercfg.exe commands, registry tampering of HibernateEnabled, deletion/modification of the hiberfil.sys file, and suspicious PowerShell usage. Such activity is often leveraged by attackers to maintain persistence or disrupt forensic evidence.
Detects the execution of built-in Windows commands "del" or "erase" to delete files. Adversaries often delete files to remove traces of their intrusion activity, minimize their footprint, or clean up after malware execution. This rule specifically looks for `cmd.exe` executing these commands, potentially with flags like `-f` (force delete), `-s` (delete from subdirectories), or `-q` (quiet mode).
Yara rule that detects PathWiper trojan.
This detection identifies the deletion of files within the AutomaticDestinations folder, located under a user’s AppData\Roaming\Microsoft\Windows\Recent directory. These files are part of the Windows Jump List feature, which records recently accessed files and folders tied to specific applications. Each .automaticDestinations-ms file corresponds to a program (e.g., Explorer, Word, Notepad) and can be valuable for forensic analysis of user activity. Adversaries may target this folder to erase evidence of their actions, such as which documents or directories were accessed during a session. This type of deletion is rarely seen during normal user activity and may indicate deliberate anti-forensic behavior. When correlated with suspicious logon events, RDP usage, or script execution, this activity may represent an attempt to cover tracks after data access, lateral movement, or staging for exfiltration. Detecting removal of these artifacts can highlight post-compromise cleanup efforts and help analysts reconstruct attacker behavior.
This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory. These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance. Deleting these files may indicate an attempt to remove forensic evidence of RDP usage. While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access. When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity.
This detection identifies the deletion of the Default.rdp file from a user’s Documents folder. This file is automatically created or updated by the Remote Desktop Connection client (mstsc.exe) whenever a user initiates an RDP session. It contains session configuration data, such as the remote hostname and display settings. While the presence of this file is normal during legitimate RDP usage, its deletion may indicate an attempt to conceal evidence of remote access activity. Threat actors and red team operators often remove Default.rdp as part of post-access cleanup to evade forensic detection. Detecting this action—especially when correlated with recent RDP activity—can help identify defense evasion techniques and uncover potentially malicious use of remote desktop connections. Monitoring for this file's deletion adds an important layer of visibility into user behavior and can serve as an early indicator of interactive attacker presence.
The analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. This activity is a technique used by ransomware to prevent forensic recovery of deleted files, hindering incident response efforts by making it impossible to recover critical data.
The following analytic detects the execution of the sdelete.exe application, a Sysinternals tool often used by adversaries to securely delete files and remove forensic evidence from a targeted host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as sdelete.exe is not commonly used in regular operations and its presence may indicate an attempt to cover malicious activities. If confirmed malicious, this could lead to the loss of critical forensic data, hindering incident response and investigation efforts.
This detection looks for any mass deletion events on an endpoint from a previously unseen and unsigned executable.
This analytic identifies a suspicious process that deletes the Mark-of-the-Web (MOTW) data stream. It leverages Sysmon EventCode 23 to detect when a file's Zone.Identifier stream is removed. This activity is significant because it is a common technique used by malware, such as Ave Maria RAT, to bypass security restrictions on files downloaded from the internet. If confirmed malicious, this behavior could allow an attacker to execute potentially harmful files without triggering security warnings, leading to further compromise of the system.
Detects attempts to remove traces of Remote Desktop Protocol (RDP) activity by clearing specific event logs, deleting registry keys, or removing cache files. This rule identifies command-line actions using 'wevtutil' to clear RDP operational logs, 'reg delete' for RDP client registry keys, and 'del' or 'remove-item' for RDP bitmap cache files. It also directly monitors registry events for RDP client key deletions and file events for RDP cache file deletions.
Detects the deletion of the "Zone.Identifier" Alternate Data Stream (ADS) by an uncommon process. Attackers can leverage this to bypass security restrictions that rely on the ADS, such as those in Microsoft Office applications, which use the Mark-of-the-Web (MOTW) to flag files downloaded from the internet.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
Detects when a process attempts to delete its own executable file. This action is often difficult to perform directly and can be a tactic used by malware to remove its traces from a compromised system, making forensic analysis harder.
This analytic identifies a suspicious process that is recursively deleting executable files on a compromised host. It leverages Sysmon Event Codes 23 (File Delete) and 26 (File Delete logged) to detect this activity by monitoring for a high volume of deletions or overwrites of files with extensions like .exe, .sys, and .dll within a short timeframe. This behavior is significant as it is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer, which aim to make file recovery impossible. If confirmed malicious, this activity could lead to significant data loss and system instability, severely impacting business operations.
Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
This analytic identifies when a repository is deleted within a GitHub organization. The detection monitors GitHub Organizations audit logs for repository deletion events by tracking actor details, repository information, and associated metadata. This behavior is concerning for SOC teams as malicious actors may attempt to delete repositories to destroy source code, intellectual property, or evidence of compromise. Repository deletion can result in permanent loss of code, documentation, and project history if proper backups are not maintained. Additionally, unauthorized repository deletion could indicate account compromise, insider threats, or attempts to disrupt business operations. The impact of a repository deletion attack includes loss of intellectual property, disruption to development workflows, and potential financial losses from lost work. Early detection of unauthorized repository deletions allows security teams to investigate potential compromises and restore from backups if needed.
This analytic detects the usage of PowerShell to delete its command history file, which may indicate an attempt to evade detection by removing evidence of executed commands. PowerShell stores command history in ConsoleHost_history.txt under the user’s profile directory. Adversaries or malicious scripts may delete this file using Remove-Item, del, or similar commands. This detection focuses on file deletion events targeting the history file, correlating them with recent PowerShell activity. While legitimate users may occasionally clear history, frequent or automated deletions should be investigated for potential defense evasion or post-exploitation cleanup activities.
This analytic detects suspicious PowerShell commands that attempt to delete the Windows Defender directory. It specifically looks for PowerShell Script Block Logging (EventCode 4104) entries containing "rmdir" and targeting paths related to "\Microsoft\Windows Defender". Such activity is critical as it suggests an adversary is trying to disable or corrupt Windows Defender, which is a key security component. If successful, this could allow an attacker to bypass endpoint protection and facilitate further malicious activities without detection.
Page 31 of 36