Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects the deletion of Kubernetes log events, which could indicate an attempt at defense evasion or covering tracks by an attacker. The rule looks for 'delete' operations on 'Event' resources while excluding actions by 'ci-admin*' or 'system:*' users to reduce false positives.
The following rule detects attempts to tamper with Linux log records by looking for interpreter processes, or common utility commands interacting with critical log files such as /var/log/wtmp, /var/log/btmp, or /var/run/utmp. It also includes scenarios where 'dd' or 'cp' might be used with /dev/null or /dev/zero to effectively clear or overwrite log content.
Detects logs cleared in MacOS systems
Query identity the deletetion of the file ConsoleHost_history.txt, the file stores the process command line history of Powershell
This rule detects attempts to delete S3 bucket logging configurations originating from IP addresses not associated with AWS infrastructure. This could indicate an attacker attempting to cover their tracks by disabling logging for an S3 bucket after gaining unauthorized access.
Detects specific commands commonly used to remove or empty the syslog, a technique often used by attackers to hide their tracks. This rule identifies the use of utilities like 'rm', 'unlink', 'mv', 'truncate', 'ln', 'cp', 'shred', and 'journalctl' when their command lines target '/var/log/syslog' or perform actions that would clear syslog content.
This rule detects the use of the vssadmin.exe command-line tool to delete volume shadow copies. This is a common and high-confidence technique used by ransomware and other malicious actors to prevent system recovery and increase their leverage.
Detects usage of known PowerShell cmdlets such as "Clear-EventLog", "Remove-EventLog", "Limit-EventLog", "Clear-WinEvent", or direct .NET calls to clear Windows event logs. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
Detects the execution of multiple commands commonly used by Dire Wolf ransomware to delete backups, shadow copies, and event logs, thereby inhibiting system recovery. The rule triggers when more than one of these anti-recovery commands are executed on the same host within a 10-minute window, distinguishing malicious patterns from isolated, legitimate administrative actions.
Detects the use of the PsLogList utility to dump Windows event logs (security, application, system) or to clear them. This activity can be indicative of account discovery attempts or anti-forensics techniques by adversaries.
Detects when logs are cleared using the legitimate tool "wevtutil". This is usually done by threat actors to clear traces using LOLBins.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
This detection identifies the use of the `esxcli system auditrecords` commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. The rule specifically looks for the use of these commands with 'remote' or 'local' arguments, excluding commands executed within a shell.
Detects attempts to remove traces of Remote Desktop Protocol (RDP) activity by clearing specific event logs, deleting registry keys, or removing cache files. This rule identifies command-line actions using 'wevtutil' to clear RDP operational logs, 'reg delete' for RDP client registry keys, and 'del' or 'remove-item' for RDP bitmap cache files. It also directly monitors registry events for RDP client key deletions and file events for RDP cache file deletions.
KQL Query from file: Detecting Abuse of Wevtutil.exe in LOLBAS Attacks
This analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
'This query looks for diagnostic settings that are removed from a resource.
This could indicate an attacker or malicious internal trying to evade detection before malicious act is performed.
If the diagnostic settings are being deleted as part of a parent resource deletion, the event is ignores.'
This could indicate an attacker or malicious internal trying to evade detection before malicious act is performed.
If the diagnostic settings are being deleted as part of a parent resource deletion, the event is ignores.'
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services.
It finds all user accounts that have logged on to an endpoint affected by Cobalt Strike, a penetration tool.
Assume that all credentials on endpoints affected by Cobalt Strike were available to attackers and that all associated accounts are compromised. Note that attackers will not only dump credentials for accounts that have logged on to interactive or RDP sessions, but will also dump cached credentials and passwords for service accounts and scheduled tasks that are stored in the LSA Secrets section of the registry.
Reference - https://attack.mitre.org/software/S0154/
It finds all user accounts that have logged on to an endpoint affected by Cobalt Strike, a penetration tool.
Assume that all credentials on endpoints affected by Cobalt Strike were available to attackers and that all associated accounts are compromised. Note that attackers will not only dump credentials for accounts that have logged on to interactive or RDP sessions, but will also dump cached credentials and passwords for service accounts and scheduled tasks that are stored in the LSA Secrets section of the registry.
Reference - https://attack.mitre.org/software/S0154/
Page 10 of 12