Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,401
11,795
5,864
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Yara rule that detects Elpaco ransomware.
Backup Files Deleted
Sigma
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team. The script specifically targets files related to 'usersfiles.war' and 'SysAidServer' within a Tomcat directory, indicating an attempt to clean up traces of an intrusion or exploit.
This rule detects attempts to exploit the PrintNightmare vulnerability (CVE-2021-1675) by monitoring for DLL deletions within the Windows Spooler Service driver folder. Specifically, it looks for `spoolsv.exe` deleting files in `C:\Windows\System32\spool\drivers\x64\3\`, which is a common indicator of this exploit.
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
Clear Linux Logs
Sigma
Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.
Detects attempts to clear macOS system logs by identifying common commands used for file deletion ('rm', 'unlink', 'shred') when targeting known log directories such as '/var/log' or user-specific '/Users/*/Library/Logs/'. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system.
This rule identifies when secrets stored in Azure Key Vaults are modified or deleted. It specifically looks for operations such as writing, deleting, backing up, purging, updating, recovering, restoring, or setting secrets within Azure Key Vaults. This activity can indicate unauthorized access to sensitive credentials or an attempt to disrupt services by removing critical secrets.
This rule detects specific commands commonly used to remove or empty the syslog file on Linux systems. Adversaries may clear or modify system logs to remove evidence of their activities, hindering incident response and forensic analysis. The rule specifically looks for 'rm' commands with various flags (e.g., -r, -f, -rf) and 'mv' commands targeting '/var/log/syslog', as well as redirection to empty the file ('>/var/log/syslog').
Detects when Microsoft Cloud App Security reports an unusual volume of file deletions by a user, which could indicate malicious activity such as data destruction or ransomware.
This rule detects attempts to delete history files, such as bash_history or zsh_history, on Linux systems. Adversaries often delete these files to remove traces of their activities and hinder forensic analysis. The rule specifically looks for process creation events where commands like 'rm', 'unlink', or 'shred' are used with command-line arguments indicating history files.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
This rule detects the deletion of TeamViewer log files. Adversaries may delete these logs to remove forensic evidence of their activity, making it harder to trace their actions or identify their presence on a system. The rule specifically looks for file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", while excluding deletions performed by 'C:\Windows\system32\svchost.exe' to reduce false positives.
Detects the deletion of Apache Tomcat web server logs, which could indicate an adversary attempting to remove forensic evidence of their activities on the server. The rule specifically looks for deletion events targeting files within paths containing '\Tomcat\logs\' and filenames matching common Tomcat log patterns like 'catalina.', '_access_log.', or 'localhost.'.
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity.
This rule detects the deletion of prefetch files, which are used by Windows to speed up application launch times. Adversaries may delete these files to remove forensic evidence of their activities, making it harder to determine what applications were executed on a compromised system. The rule specifically looks for files ending with '.pf' within the ':\Windows\Prefetch\' directory. A filter is applied to exclude deletions performed by 'svchost.exe' with 'AUTHORI' or 'AUTORI' in the user field, as these are often legitimate system activities.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Page 35 of 36