Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects the use of the tool cipher.exe to delete indicators of malicious activity right before encrypting a drive.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects the use of the tool cipher.exe to delete indicators of malicious activity right before encrypting a drive.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
Detects the load of advapi31.dll by a process running in an uncommon folder
Detects possible Sysmon filter driver unloaded via fltmc.exe
Shadow Copies deletion using operating systems utilities
Detects the deletion of registry keys containing the MSTSC connection history
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
'This detection looks the prevention of crash dumps being created. This can be used to limit reporting by malware, look for suspicious processes setting this registry key.'
Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
This analytic detects the execution of the 'fsutil' command with the 'setzerodata' parameter, which zeros out a target file. This activity is significant because it is a technique used by ransomware, such as LockBit, to evade detection by erasing its malware path after encrypting the host. If confirmed malicious, this action could hinder forensic investigations and allow attackers to cover their tracks, complicating incident response efforts.
This analytic identifies a process attempting to delete its own executable file using `cmd.exe` and the `del` command. This behavior is often associated with defense evasion techniques employed by malware, such as Clop ransomware, to remove its executable file after execution or under specific conditions. Detecting such activity is crucial for identifying malicious actors trying to evade detection and complicate incident response efforts.
The following analytic detects processes that clear or free page cache on a Linux system. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line executions involving the kernel system request `drop_caches`. This activity is significant as it may indicate an attempt to delete forensic evidence or the presence of wiper malware like Awfulshred. If confirmed malicious, this behavior could allow an attacker to cover their tracks, making it difficult to investigate other malicious activities or system compromises.
This analytic detects the execution of `rundll32.exe` with command-line arguments specifically designed to clear the Shimcache (Application Compatibility Cache) by calling `apphelp.dll,ShimFlushCache`. Clearing the Shimcache is an anti-forensic technique used by adversaries to remove forensic artifacts and evade detection, making it harder for incident responders to trace their activities and maintain persistence on a compromised system.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
This rule detects the removal of an exported Exchange mailbox using the 'Remove-MailboxExportRequest' cmdlet with the '-Confirm "False"' parameter. This activity could indicate an adversary attempting to cover their tracks after exfiltrating data, potentially following an exploit like ProxyShell.
Detects the deletion of Apache Tomcat web server logs, which could indicate an adversary attempting to remove forensic evidence of their activities on the server. The rule specifically looks for deletion events targeting files within paths containing '\Tomcat\logs\' and filenames matching common Tomcat log patterns like 'catalina.', '_access_log.', or 'localhost.'.
Detects when an Amazon Simple Email Service (SES) identity is deleted. This action could be performed by an adversary to remove traces of their activities after using the SES identity for malicious purposes, such as sending spam or phishing emails, aligning with defense evasion tactics.
Detects the deletion of Exchange PowerShell cmdlet history logs, which may indicate an attempt by an adversary to destroy forensic evidence and evade detection. This action can hinder incident response and forensic analysis.
This rule detects the deletion of Windows Event Log (EVTX) files. Adversaries often delete these logs to remove forensic evidence of their activities, making it harder for defenders to investigate and understand the scope of a compromise. The rule specifically looks for file deletion events where the target filename starts with 'C:\Windows\System32\winevt\Logs\' and ends with '.evtx', which are the standard locations and extensions for Windows Event Log files.
This rule detects the deletion of PowerShell console history logs, specifically the 'ConsoleHost_history.txt' file located within the 'PSReadLine' directory. Adversaries often delete these logs to remove forensic evidence of their commands and activities, making it harder for defenders to trace their actions and understand the scope of a compromise. This action is a common defense evasion technique.
This rule identifies attempts to clear the PowerShell console history. Adversaries often clear command history to remove traces of their activities on a compromised system, making forensic analysis more difficult. The rule specifically looks for the 'Clear-History' cmdlet or the deletion of the 'ConsoleHost_history.txt' file, which stores PowerShell command history.
Page 9 of 10