Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
390 detections
Filters
Last updated
All Time
Detection languages
150
87
71
26
16
Contributors
58
55
51
39
39
Categories
189
94
84
82
59
Platforms
185
68
60
30
27
Products / Services
73
57
50
43
31
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
IDS Protocols
4
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects the execution of the GigaWiper malware or the use of common system commands associated with destructive data activities, such as recursive file removal, disk formatting, or secure data overwriting, often used by threat actors for extortion.
Detects a suspected automated exploitation sequence where a web storefront file (e.g., .phtml, .js, .php) is modified to inject malicious script code (skimmer), followed by an unauthorized SQL DELETE operation on sensitive database tables containing payment, customer, or order information, originating from the same host within a 6-hour window.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects high-risk destructive database operations (DROP, TRUNCATE, or UPDATE) on sensitive tables executed within six hours of a large outbound data transfer from the same host, a pattern indicative of anti-forensic database wiping following data exfiltration.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects potential misuse of AI agentic frameworks (e.g., Semantic Kernel) where the host process executes destructive commands (e.g., file deletion, wiping, shadow copy deletion) or performs large-scale file deletion, which may indicate unauthorized tool invocation or compromised AI agents.
Detects autonomous AI coding-agent processes (e.g., Claude Code, Cursor, Aider) spawning shell or git processes to perform potentially destructive actions such as recursive file deletion, forced git pushes, database manipulation, or unauthorized access to sensitive credential files, indicating agentic 'excessive agency' or compromise.
Detects coordinated activity indicative of destructive malware propagation similar to NotPetya. The rule identifies a three-stage sequence on a single host: execution of a DLL via rundll32.exe, followed by file writes to administrative network shares (C$/ADMIN$), and remote process creation via WMI (WmiPrvSE.exe), correlated with a high volume of SMB connections.
Detects the execution of destructive SQL commands (e.g., DROP, TRUNCATE, mass DELETE) via common command-line database clients. These patterns are often observed when threat actors attempt to destroy forensic evidence or interrupt database availability immediately following unauthorized data exfiltration.
Detects a service principal attempting to delete multiple Azure SQL databases in a short timeframe, resulting in failures. This pattern is characteristic of malicious data destruction activity, such as that observed in Storm-3168 (JADEPUFFER) campaigns, but accounts for the possibility of misconfigured infrastructure-as-code pipelines by requiring a high volume of failed requests across distinct resources.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects high-frequency file deletion events originating from processes with names or command-line indicators associated with AI orchestration frameworks like Semantic Kernel. This behavior may indicate an adversary abusing legitimate AI agent tools to perform unauthorized data destruction.
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
Detects a single user identity performing bulk destructive device actions (wipe, retire, remote lock, or delete) against multiple distinct devices within a short timeframe. This activity is indicative of potential unauthorized access and destructive intent, mirroring techniques observed in large-scale cloud-based identity compromise incidents.
This rule detects potentially malicious activity involving Node.js modules. It monitors for the deletion of specific 'sharedLoad.min.js' or 'extended' files within 'node_modules' directories, the execution of Node.js processes attempting file deletion operations (like 'unlink' or 'rm') within 'node_modules', and the creation or modification of JavaScript files within 'node_modules' that contain 'btree' references. This activity may indicate an attempt to tamper with application dependencies, inject malicious code, or remove artifacts.
Detects instances where an AI agent (e.g., Semantic Kernel) launches command-line tools commonly used to perform bulk data destruction or system wiping, such as file deletion commands, volume shadow copy removal, or disk formatting. This rule flags suspicious orchestration by AI agents that may be acting outside of expected parameters.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
Page 2 of 19