Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects deletion of content within Zendesk. Removing attachments or tickets destroys
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
Detects deletion of a managed resource from the vault following privileged access to
it. Removing the resource destroys the record of which credentials existed and who
held them, which is both destructive and a way of covering the preceding access.
Treat the deletion as evidence tampering rather than as routine housekeeping unless
a decommissioning record exists.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='RESOURCE_DELETED'
| groupby user, targetuser, srcip, message
it. Removing the resource destroys the record of which credentials existed and who
held them, which is both destructive and a way of covering the preceding access.
Treat the deletion as evidence tampering rather than as routine housekeeping unless
a decommissioning record exists.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='RESOURCE_DELETED'
| groupby user, targetuser, srcip, message
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
The following analytic detects the deletion of the USN Journal using the fsutil.exe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because the USN Journal maintains a log of all changes made to files on the disk, and its deletion can be an indicator of an attempt to cover tracks or hinder forensic investigations. If confirmed malicious, this action could allow an attacker to obscure their activities, making it difficult to trace file modifications and potentially compromising incident response efforts.
The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
The following analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
Detects command-line activity on a NetScaler appliance indicative of defense evasion by truncating, deleting, or disabling audit logs (ns.log) and syslog forwarding services. This activity often follows the exploitation of public-facing application vulnerabilities where an attacker seeks to hide their presence.
This rule monitors for activity associated with specific known malicious file names (killer.exe, kill.exe) and network connections to a set of identified malicious IP addresses. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential communication or presence of these malicious artifacts.
This rule detects potential anti-forensic activity on Citrix ADC/NetScaler devices by monitoring for two primary indicators of log tampering: an unexpected drop in syslog volume to zero following a period of activity, or the execution of explicit commands intended to clear audit logs and configuration files.
Detects unauthorized or suspicious modifications to audit and logging configurations across AWS, Azure, and GCP. The rule identifies actions such as stopping, deleting, or updating logging trails, diagnostic settings, or logging sinks, which may indicate an adversary attempting to impair visibility into their activities (Anti-Forensics).
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
Detects the modification of Microsoft IIS configuration to disable HTTP logging using the appcmd.exe utility. This technique is often used by adversaries to impair security monitoring and evade detection after compromising a web server.
Detects anomalous database activity on Magento e-commerce platforms where a SELECT operation against sensitive payment-related tables is followed by a DELETE operation on the same table within the same host context. This sequence is indicative of an attacker exfiltrating credit card data and subsequently attempting to remove forensic evidence of the theft.
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects anomalous anti-forensic behavior where a Salesforce Bulk API query job is deleted shortly after its creation or completion. This sequence is often associated with efforts to obscure data exfiltration activities by removing the metadata trail of bulk data exports.
This rule monitors for activity associated with specific known malicious file names (killer.exe, kill.exe) and network connections to a set of identified malicious IP addresses. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential communication or presence of these malicious artifacts.
This rule monitors for activity associated with specific known malicious file names (killer.exe, kill.exe) and network connections to a set of identified malicious IP addresses. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential communication or presence of these malicious artifacts.
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Page 1 of 10