Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
390 detections
Filters
Last updated
All Time
Detection languages
150
87
71
26
16
Contributors
58
55
51
39
39
Categories
189
94
84
82
59
Platforms
185
68
60
30
27
Products / Services
73
57
50
43
31
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
IDS Protocols
4
Detects suspicious activity on VMware ESXi hosts involving the termination or unregistration of virtual machines via 'esxcli' or 'vim-cmd', correlated with high volumes of file modification or creation events (.vmdk or .vmx files) within a short window. This pattern often indicates attempts to disrupt virtual machines or inhibit system recovery by adversaries.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects a service principal attempting to delete multiple Azure SQL databases in a short timeframe, resulting in failures. This pattern is characteristic of malicious data destruction activity, such as that observed in Storm-3168 (JADEPUFFER) campaigns, but accounts for the possibility of misconfigured infrastructure-as-code pipelines by requiring a high volume of failed requests across distinct resources.
Detects a service principal attempting to delete multiple Azure SQL databases in a short timeframe, resulting in failures. This pattern is characteristic of malicious data destruction activity, such as that observed in Storm-3168 (JADEPUFFER) campaigns, but accounts for the possibility of misconfigured infrastructure-as-code pipelines by requiring a high volume of failed requests across distinct resources.
Detects a service principal attempting to delete multiple Azure SQL databases in a short timeframe, resulting in failures. This pattern is characteristic of malicious data destruction activity, such as that observed in Storm-3168 (JADEPUFFER) campaigns, but accounts for the possibility of misconfigured infrastructure-as-code pipelines by requiring a high volume of failed requests across distinct resources.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects the use of built-in Windows utilities and commands to disable system recovery features, delete volume shadow copies, clear backup catalogs, or perform mass file deletion. This behavior is highly indicative of wiper malware preparing for a destructive attack by preventing system recovery.
Detects a suspicious volume of cloud resource deletions occurring within a short 15-minute window, specifically targeting multiple storage accounts and SQL database/server instances. This behavior is indicative of a malicious actor or an automated script attempting to disrupt business operations or destroy data.
Detects a process that has established a connection to the Telegram Bot API subsequently performing a large volume of file deletions across multiple folders within a 15-minute window. This behavior is indicative of a remote-controlled destructive attack, such as the deployment of a wiper malware (e.g., HEAVYGRAM or CHOSEN BRICK) triggered via Telegram C2 commands.
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite deleted data on a disk to prevent forensic recovery. This is a common technique used by adversaries to perform data destruction or cover their tracks.
Detects the rare 'AssumeRoot' event in AWS STS followed by high-impact administrative or destructive API calls within a one-hour window. This behavior often indicates an adversary attempting to gain elevated, privileged access to perform unauthorized actions such as disabling logging, deleting infrastructure, or modifying IAM policies.
Detects execution of mass file-deletion or system wipe commands triggered by processes running from known persistence or staging locations associated with the CHOSEN BRICK campaign. The rule monitors for the combination of suspicious process paths (such as disguised winappx.exe or SysWOW64-lookalike directories) and destructive command-line arguments like 'del', 'cipher', 'format', or 'vssadmin' operations.
Page 3 of 19