Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
2
1
Contributors
2
1
1
1
Categories
2
2
1
1
1
Platforms
5
Products / Services
3
1
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects the use of Windows administrative tools (vssadmin, wbadmin, and bcdedit) to delete Volume Shadow Copies, backup catalogs, and disable system recovery mechanisms. This behavior is highly indicative of preparatory stages for destructive wiper malware attacks, such as those historically observed by the Sandworm (Seashell Blizzard) group (e.g., CaddyWiper, Industroyer2).
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
This analytic identifies a suspicious process that is recursively deleting executable files on a compromised host. It leverages Sysmon Event Codes 23 (File Delete) and 26 (File Delete logged) to detect this activity by monitoring for a high volume of deletions or overwrites of files with extensions like .exe, .sys, and .dll within a short timeframe. This behavior is significant as it is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer, which aim to make file recovery impossible. If confirmed malicious, this activity could lead to significant data loss and system instability, severely impacting business operations.
This rule detects the CaddyWiper trojan, a destructive data wiper, by identifying specific byte patterns within executable files. The patterns correspond to functions involved in destroying data if the system is not a controller, erasing drive data, and recursively erasing drives.
Yara rule that detects CaddyWiper trojan.