Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
This rule detects attempts to tamper with critical Linux log files such as /var/log/auth.log, /var/log/syslog, and /var/log/audit/audit.log. It specifically looks for file deletion or modification events, or process creation events that involve commands like 'rm', 'shred', 'truncate', 'unlink', or 'dd' targeting these log files. Legitimate processes like 'logrotate', 'rsyslog', 'syslog-ng', 'auditd', 'systemd', and 'journald' are excluded to reduce false positives.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
Detects the clearing of multiple Windows Event Logs using the built-in 'wevtutil.exe' utility. This behavior is often associated with adversaries attempting to remove evidence of their presence or activities by clearing system, security, or application event logs.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects the execution of 'wevtutil.exe' with the 'cl' or 'clear-log' arguments targeted at primary Windows Event Logs (Security, System, or Application). This activity is commonly associated with an adversary attempting to clear audit logs to conceal malicious actions during an intrusion.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
Detects Kazuar clearing specific Security logs via the ClearEventLog Windows API immediately after lateral movement. The rule specifically looks for 'ClearEventLogApiCall' actions and excludes common legitimate tools like 'wevtutil.exe' and 'powershell.exe' that might perform similar actions.
Detects the specific defense evasion tactic where malware invokes wevtutil to clear event logs immediately after executing its payload, effectively taunting defenders. This rule specifically looks for 'wevtutil.exe' being executed with the 'cl' (clear log) command-line argument, and filters out common legitimate processes like cmd.exe, powershell.exe, and explorer.exe as initiating processes.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects attempts to clear syslog files by looking for the command 'truncate -s 0' followed by 'syslog' within an SSH session. This activity is often associated with an attacker trying to remove evidence of their presence on a compromised system.
Detects clearing of Linux system log files to remove forensic evidence
This rule detects when Windows Security or System event logs are cleared. Adversaries often clear event logs to remove evidence of their activities after gaining access to a system.
This rule detects attempts to clear system log files, specifically '/var/log/', via a remote SSH connection. It looks for the string "> /var/log/" within TCP traffic on port 22 (SSH) flowing from a client to a server, ignoring case. This activity is often associated with an attacker trying to cover their tracks by removing evidence of their presence.
This rule detects when the Windows Security Event Log (Event ID 1102) has been cleared on a system. Clearing event logs is a common technique used by adversaries to remove traces of their activity and evade detection.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
Page 8 of 12