Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
390 detections
Filters
Last updated
All Time
Detection languages
150
87
71
26
16
Contributors
58
55
51
39
39
Categories
189
94
84
82
59
Platforms
185
68
60
30
27
Products / Services
73
57
50
43
31
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
4
IDS Protocols
4
Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
Detects when Microsoft Cloud App Security reports an unusual volume of file deletions by a user, which could indicate malicious activity such as data destruction or ransomware.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
This rule identifies when an Amazon Elastic Kubernetes Service (EKS) cluster is either created or deleted. Monitoring these events can help detect unauthorized infrastructure changes, potential resource exhaustion, or malicious activity aimed at disrupting services or destroying data within a cloud environment.
Detects when adversaries delete important scheduled tasks related to system restore, Windows Defender, BitLocker, Windows Backup, Windows Update, Update Orchestrator, or Exploit Guard. This activity could indicate an attempt to disrupt system services or processes, potentially as a precursor to data destructive activities or to hinder defensive capabilities.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Detects when an AWS EFS (Elastic File System) mount target is deleted. This action can disrupt applications or instances relying on the mounted file system, potentially leading to a denial of service or data unavailability.
Detects the execution of Sysinternals Sdelete when its executable file has been renamed from its original name (sdelete.exe or sdelete64.exe). This behavior is often indicative of an attempt to evade detection or obscure the use of a legitimate tool for malicious purposes, such as data destruction.
Detects the use of the built-in Windows utility 'cipher.exe' with the '/w:' argument to overwrite deleted data on disk. This technique is often used by adversaries to destroy data and files, making them irrecoverable by forensic methods, thereby impacting system availability.
This rule detects suspicious invocations of the `fsutil.exe` utility, specifically when it's used to delete the USN journal, create a USN journal with a small size, or set zero data to a file. These actions are often associated with ransomware or other malicious activity aimed at defense evasion and data destruction, as seen in campaigns like NotPetya and Lockbit.
Detects the execution of Sysinternals SDelete to overwrite a specific file, rather than its intended use of wiping free space or entire volumes. This activity is indicative of an adversary attempting to destroy data to prevent recovery or forensic analysis.
Identifies when an EKS cluster is created or deleted.
Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
Identifies when a device or device configuration in azure is modified or deleted.
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
DD File Overwrite
Sigma
Detects potential overwriting and deletion of a file using DD.
Page 18 of 19