Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects clear-text attempts to clear Windows Event Logs using 'wevtutil' or 'Clear-EventLog' command patterns within network traffic, indicating a potential attempt to remove evidence of malicious activity on a host.
Detects evidence of log deletion, logrotate configuration modification, or syslog daemon termination (rsyslog, syslog-ng, journald) occurring within 30 minutes of suspicious child process activity from common web application interpreters (e.g., python, node, java, php). This correlation pattern is a strong indicator of post-exploitation activity aimed at clearing tracks or impairing host logging services.
This rule detects when the Windows Security Event Log (Event ID 1102) has been cleared on a system. Clearing event logs is a common technique used by adversaries to remove traces of their activity and evade detection.
Detects attempts to clear Windows Event Logs using common utilities like 'wevtutil' or 'Clear-EventLog', or execution triggered by batch scripts (e.g., i.bat), which is often associated with adversaries attempting to remove evidence of their activities.
Detects attempts to clear Windows event logs using the native 'wevtutil' command-line utility or PowerShell 'Clear-EventLog' command. The rule applies elevated risk levels when the activity is initiated by system-level processes or accounts, which is often indicative of adversary activity attempting to remove forensic evidence of post-exploitation actions.
This rule detects activities associated with the StrikeShark SharkLoader malware, specifically its attempts to suppress Event Tracing for Windows (ETW) and tamper with event logs. It identifies the use of 'wevtutil.exe' to clear security logs, 'auditpol.exe' to disable audit categories, the loading of specific DLLs ('SyncRes.dat', 'DscCoreR.mui', 'SystemSettings.dll') from suspicious AppData paths, and processes originating from these suspicious AppData paths spawning 'wevtutil.exe' or 'auditpol.exe'.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
This rule detects activities related to clearing or deleting Windows Event Logs, including usage of 'wevtutil.exe' to clear specific logs, 'cmd.exe' or PowerShell ('Remove-Item') to manually delete '.evtx' files, and the erasure of the USN journal via 'fsutil.exe'. It also detects the actual occurrence of Event IDs 1102 (Security log cleared) and 104 (System log cleared). The rule correlates these events with preceding service installations within the last 24 hours to distinguish between potential attacker anti-forensics activity and routine administrative maintenance.
Detects clearing of bash command history to remove forensic evidence
Detects various phases of the Grixba infostealer infection lifecycle, including persistence via file drops in public user directories, malicious DLL/payload creation, reconnaissance data exfiltration, security software tampering (Windows Defender, AMSI, WLDP), and event log clearing via wevtutil.
This rule detects attempts to tamper with critical Linux log files such as /var/log/auth.log, /var/log/syslog, and /var/log/audit/audit.log. It specifically looks for file deletion or modification events, or process creation events that involve commands like 'rm', 'shred', 'truncate', 'unlink', or 'dd' targeting these log files. Legitimate processes like 'logrotate', 'rsyslog', 'syslog-ng', 'auditd', 'systemd', and 'journald' are excluded to reduce false positives.
Detects attempts by a user or process to clear audit logs, system logs, or command history, often used by adversaries to cover their tracks on a compromised system. The rule monitors for file deletion (rm, shred), content truncation (truncate), selective line removal (sed -i), and shell history suppression (HISTFILE=/dev/null, history -c) against sensitive log and history paths.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects suspicious file deletion activities using 'del' command with '/f' flag or 'Remove-Item' PowerShell cmdlet, and log clearing activities using 'wevtutil cl' or 'Clear-EventLog' PowerShell cmdlet. It also identifies Windows Event Log clearing events (Event ID 1102). The rule also includes a specific check for known malicious artifacts in the command line.
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects attempts to clear Windows event logs using the native command-line utility 'wevtutil' or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their activities from security, system, and application logs. The rule includes exclusions for common administrative, backup, and security-related processes to minimize false positives.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.
Detects usage of the Windows Event Utility (wevtutil.exe) with the 'cl' command-line flag, which is commonly used to clear specific Windows Event logs such as Security, System, Application, or Setup. This behavior is frequently associated with attackers attempting to remove forensic artifacts and log entries after unauthorized activity.
Page 6 of 12