Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects Windows Security (1102) or System (104) log clearing events that occur within 30 minutes of privileged activity (new account creation, group membership changes, or service installation) on the same host, sharply reducing false positives versus alerting on log clears alone.
Detects attempts by an adversary to disable or clear Windows Event logs using standard administrative utilities such as wevtutil, PowerShell, auditpol, net, sc, or wmic to cover tracks or hinder forensic analysis.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their presence or malicious activities from a compromised system.
This rule monitors network device audit logs for suspicious activities that indicate potential persistence or defense evasion on edge/VPN/router appliances. It specifically flags configuration changes, creation of new administrative accounts, addition of unauthorized SSH keys, and the disabling of logging/syslog export, which are common tactics for maintainig unauthorized access on network infrastructure.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects unauthorized attempts to stop, delete, or reduce the scope of AWS CloudTrail logging. Attackers frequently perform these actions to blind defenders before conducting large-scale resource abuse or ransomware activities. This rule monitors for StopLogging, DeleteTrail, and configuration changes (UpdateTrail, PutTrail) that weaken log integrity such as disabling multi-region tracking, global service events, or log file validation.
Detects the deletion of AWS CloudWatch log groups, log streams, metric filters, CloudWatch alarms, and VPC Flow Logs. Such actions are often indicative of an adversary attempting to destroy forensic evidence or disable security alerting prior to further unauthorized activity, such as data exfiltration or resource abuse.
Detects the deletion of Azure Monitor diagnostic settings or log profiles that export subscription-level Activity Logs. This action disables logging, effectively blinding security visibility into tenant operations, and is often used by adversaries as a defense-evasion technique before conducting further malicious activities.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects unauthorized attempts to stop, delete, modify, or change event selectors for AWS CloudTrail logs. This activity is indicative of an attacker attempting to disable audit logging to evade detection while performing further malicious actions in the environment.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
Detects the clearing of Windows Security Event Logs (EventID 1102) within 15 minutes of a successful user logon (EventID 4624) on the same host. This activity is a common anti-forensics technique used by adversaries to hide malicious actions following an authenticated session.
Detects the clearing of Windows event logs using native 'wevtutil.exe' or PowerShell cmdlets. The rule monitors for common log-clearing commands and triggers an alert when multiple such events occur on a single host within a 15-minute window, which is indicative of bulk log-wiping often performed by ransomware or during post-exploitation defense evasion.
Detects the deletion of GitHub workflow logs that occur in close temporal proximity to sensitive operations such as secret access or package publication. The rule also flags deletions associated with workflow names containing AI-themed keywords, which may indicate an attempt to conceal malicious automation or activity.
Detects the use of the wevtutil.exe utility to clear multiple Windows event logs simultaneously. This is a common defense evasion technique used by attackers to hide malicious activity by deleting security, system, application, or setup event logs.
Detects attempts to tamper with, disable, or delete audit logging configurations in AWS CloudTrail and Azure Monitor. Monitoring these activities is critical to ensure that audit logs remain intact for security investigations.
Detects the clearing of the Windows Security Event Log. This activity is a common indicator of an adversary attempting to remove evidence of their presence or actions on a compromised host.
Detects the use of the wevtutil.exe utility to clear the Microsoft-Windows-Defender/Operational event log, a technique used by adversaries to disrupt security monitoring and hide malicious activity.
Page 2 of 12