Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects attempts to clear Windows Event Logs via common administrative tools such as 'wevtutil.exe', PowerShell, or the detection of specific system events indicating logs have been cleared (Event IDs 1102 and 104).
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell Cmdlets, or WMI providers. These actions are common techniques for attackers to impair system defenses and remove evidence of their activities from a compromised host.
Detects attempts to clear Windows Event Logs using common utilities including wevtutil, PowerShell (Clear-EventLog, EvtClearLog), or command-line wrappers. Clearing event logs is a common technique used by adversaries to disrupt incident response and cover their tracks after an intrusion.
This rule detects activities associated with post-exploitation cleanup and defense evasion on Windows systems. It identifies the clearing of Security and System event logs using 'wevtutil.exe' or PowerShell, as well as the modification of audit policies using 'auditpol.exe' to potentially disable logging or auditing capabilities.
This rule detects when the Windows Security Event Log has been cleared, which is often an indicator that an adversary is attempting to hide their tracks and remove evidence of unauthorized activities on a system.
This rule detects various techniques used by an adversary to clear, truncate, or delete system and audit logs to hide their activity. It monitors for commands targeting Windows Event Logs (wevtutil, Clear-EventLog), Linux system logs (/var/log/ via rm/shred), and journalctl vacuuming, as well as the deletion of .evtx files. It further enriches these detections by identifying if the process was spawned by suspicious parent processes often associated with remote access, lateral movement, or command-and-control activity.
This rule detects attempts to clear Windows Event Logs using either 'wevtutil.exe', PowerShell 'Clear-EventLog' command, or by monitoring specific Windows Event IDs (1102 and 104) which indicate logs have been cleared. Clearing event logs is a common technique used by attackers to hide malicious activity and evade detection.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects execution of processes associated with Grixba malware (GT_NET.exe) or suspicious attempts to clear Windows event logs using built-in utilities (wevtutil, wmic) in conjunction with common command shells or the malware itself.
Detects indicators of ransomware-related anti-forensic behavior, including the deletion of Volume Shadow Copies via vssadmin or wmic, disabling system recovery via bcdedit, and the clearing of Windows event logs via wevtutil or system event log clearing events.
Detects various methods of anti-forensics activity commonly used to hide attacker presence, including clearing Windows Event Logs via wevtutil or PowerShell, deleting the USN Journal via fsutil, and bulk file deletion using command-line utilities.
Detects evidence of log and artifact tampering on a Windows host, specifically the clearing of Windows System or Security logs using wevtutil or PowerShell, the stopping of the EventLog service, or the deletion of PowerShell PSReadLine history files. Such activity is often conducted by an adversary to conceal malicious actions.
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
Detects clear-text attempts to clear Windows Event Logs using 'wevtutil' or 'Clear-EventLog' command patterns within network traffic, indicating a potential attempt to remove evidence of malicious activity on a host.
This rule detects the use of native Windows utilities to inhibit system recovery (e.g., deleting shadow copies or boot configuration changes) and to clear system event logs. These behaviors are common precursors or indicators of post-exploitation activity, such as ransomware deployment or intrusion cleanup.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
This rule detects when the Windows Security Event Log has been cleared, which is often an indicator that an adversary is attempting to hide their tracks and remove evidence of unauthorized activities on a system.
Detects attempts to clear Windows event logs using native utilities (wevtutil), remove shell history files (bash_history, PowerShell history), or perform secure file deletion using cipher.exe, which are techniques commonly used by attackers to remove forensic evidence of their activities.
Detects attempts to delete or clear Linux system logs using common utilities (rm, shred, truncate, echo, cat) targeting critical log paths such as /var/log/syslog, /var/log/messages, and other authentication or kernel logs. This activity is indicative of an adversary attempting to remove evidence of their actions from the local system.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
Page 5 of 12