Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
250
122
32
26
24
Contributors
140
53
39
37
35
Categories
378
174
161
59
47
Platforms
383
98
29
17
10
Products / Services
142
107
48
40
20
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
3
2
2
1
IDS Classtypes
2
1
IDS Protocols
2
Clear Linux Logs
Sigma
Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.
This rule detects specific commands commonly used to remove or empty the syslog file on Linux systems. Adversaries may clear or modify system logs to remove evidence of their activities, hindering incident response and forensic analysis. The rule specifically looks for 'rm' commands with various flags (e.g., -r, -f, -rf) and 'mv' commands targeting '/var/log/syslog', as well as redirection to empty the file ('>/var/log/syslog').
This rule detects attempts to delete history files, such as bash_history or zsh_history, on Linux systems. Adversaries often delete these files to remove traces of their activities and hinder forensic analysis. The rule specifically looks for process creation events where commands like 'rm', 'unlink', or 'shred' are used with command-line arguments indicating history files.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
Detects the deletion of a backup catalog on Windows systems. This action can be performed by adversaries to inhibit system recovery, making it harder to restore systems after an attack, such as a ransomware incident.
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
This rule detects the deletion of TeamViewer log files. Adversaries may delete these logs to remove forensic evidence of their activity, making it harder to trace their actions or identify their presence on a system. The rule specifically looks for file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", while excluding deletions performed by 'C:\Windows\system32\svchost.exe' to reduce false positives.
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity.
This rule detects the deletion of prefetch files, which are used by Windows to speed up application launch times. Adversaries may delete these files to remove forensic evidence of their activities, making it harder to determine what applications were executed on a compromised system. The rule specifically looks for files ending with '.pf' within the ':\Windows\Prefetch\' directory. A filter is applied to exclude deletions performed by 'svchost.exe' with 'AUTHORI' or 'AUTORI' in the user field, as these are often legitimate system activities.
Detects the deletion of Exchange PowerShell cmdlet history logs, which may indicate an attempt by an adversary to destroy forensic evidence and evade detection. This action can hinder incident response and forensic analysis.
Detects the deletion of the "Zone.Identifier" Alternate Data Stream (ADS). Attackers can leverage this to bypass security restrictions that make use of the ADS, such as those in Microsoft Office applications. By removing this identifier, a file downloaded from the internet might be treated as a local file, potentially allowing macros or other active content to run without security warnings.
This rule detects the use of PowerShell's `Remove-Item` cmdlet or its aliases (`del`, `erase`, `rd`, `ri`, `rm`, `rmdir`) with the `-Path` parameter within a PowerShell script block. This activity is indicative of file or folder deletion, which can be used by adversaries for defense evasion or to remove traces of their activity.
This rule detects when Windows Defender logs the deletion of its malware detection history. This action can be performed by an attacker to remove traces of their activity or to prevent the system from reporting previously detected malware.
Detects the execution of the 'del' or 'erase' command-line utilities with wildcard expressions to delete files. This behavior is often observed in malware attempting to remove traces of infection or delete evidence from compromised systems. The rule specifically looks for common executable file extensions like .dll, .exe, .js, and .au3 being targeted by these deletion commands.
Detects the execution of the built-in "rmdir" command in Windows to delete directories. This activity can be used by adversaries to remove traces of their intrusion activity, such as malware, tools, or other non-native files, to minimize their footprint on a system.
This rule detects the EAF ransomware by identifying specific bytecode patterns associated with its file encryption, file finding, and file destruction functionalities. The rule looks for a combination of patterns related to encrypting files, locating files on the system, and destroying executable files, indicating the presence and activity of the EAF ransomware.
Yara rule that detects EAF ransomware.
This rule detects the Dusk ransomware by identifying specific bytecode patterns associated with its file encryption routines, file finding mechanisms, and self-deletion functionality. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header.
Yara rule that detects Dusk ransomware.
This rule detects the DenizKizi ransomware by identifying specific byte patterns associated with its file finding, file encryption, and shadow copy deletion routines. The rule requires all three sets of byte patterns to be present in a file for a match, reducing false positives.
Page 24 of 24