Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
753 detections
Filters
Last updated
All Time
Detection languages
360
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,443
11,831
5,872
5,155
4,866
753
Platforms
524
139
55
47
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Detects the deletion of Exchange PowerShell cmdlet history logs, which may indicate an attempt by an adversary to destroy forensic evidence and evade detection. This action can hinder incident response and forensic analysis.
Detects the deletion of the "Zone.Identifier" Alternate Data Stream (ADS). Attackers can leverage this to bypass security restrictions that make use of the ADS, such as those in Microsoft Office applications. By removing this identifier, a file downloaded from the internet might be treated as a local file, potentially allowing macros or other active content to run without security warnings.
This rule detects the use of PowerShell's `Remove-Item` cmdlet or its aliases (`del`, `erase`, `rd`, `ri`, `rm`, `rmdir`) with the `-Path` parameter within a PowerShell script block. This activity is indicative of file or folder deletion, which can be used by adversaries for defense evasion or to remove traces of their activity.
This rule detects the deletion of Windows Event Log (EVTX) files. Adversaries often delete these logs to remove forensic evidence of their activities, making it harder for defenders to investigate and understand the scope of a compromise. The rule specifically looks for file deletion events where the target filename starts with 'C:\Windows\System32\winevt\Logs\' and ends with '.evtx', which are the standard locations and extensions for Windows Event Log files.
This rule detects the deletion of PowerShell console history logs, specifically the 'ConsoleHost_history.txt' file located within the 'PSReadLine' directory. Adversaries often delete these logs to remove forensic evidence of their commands and activities, making it harder for defenders to trace their actions and understand the scope of a compromise. This action is a common defense evasion technique.
Detects the execution of the 'del' or 'erase' command-line utilities with wildcard expressions to delete files. This behavior is often observed in malware attempting to remove traces of infection or delete evidence from compromised systems. The rule specifically looks for common executable file extensions like .dll, .exe, .js, and .au3 being targeted by these deletion commands.
Detects the execution of the built-in "rmdir" command in Windows to delete directories. This activity can be used by adversaries to remove traces of their intrusion activity, such as malware, tools, or other non-native files, to minimize their footprint on a system.
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Detects specific commands commonly used to remove or empty the syslog
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
This rule detects the EAF ransomware by identifying specific bytecode patterns associated with its file encryption, file finding, and file destruction functionalities. The rule looks for a combination of patterns related to encrypting files, locating files on the system, and destroying executable files, indicating the presence and activity of the EAF ransomware.
This rule detects the Dusk ransomware by identifying specific bytecode patterns associated with its file encryption routines, file finding mechanisms, and self-deletion functionality. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header.
This rule detects the DenizKizi ransomware by identifying specific byte patterns associated with its file finding, file encryption, and shadow copy deletion routines. The rule requires all three sets of byte patterns to be present in a file for a match, reducing false positives.
Yara rule that detects DenizKizi ransomware.
Yara rule that detects PXJ ransomware.
Yara rule that detects Ragnarok ransomware.
Yara rule that detects TorrentLocker ransomware.
Page 36 of 36