Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
390 detections
Filters
Last updated
All Time
Detection languages
150
87
71
26
16
Contributors
58
55
51
39
39
Categories
189
94
84
82
59
Platforms
185
68
60
30
27
Products / Services
73
57
50
43
31
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
IDS Protocols
4
Detects the execution of the Windows cipher.exe utility with the '/w' flag from the command prompt. The '/w' flag is used to overwrite free space on a disk, which is a technique often used by adversaries to perform data destruction or hinder forensic recovery of deleted files.
Detects high-risk destructive database operations (DROP, TRUNCATE, or mass DELETE without a WHERE clause) performed by automated identities (AI agents, service accounts, or automation scripts) in a production environment outside of an authorized change window. This rule is designed to identify potential excessive-agency incidents where automated systems perform unauthorized destructive actions.
Detects anomalous database activity involving the creation of 'ZQ'-prefixed staging tables followed by a high-volume drop operation across multiple tables within a short timeframe. This behavior is indicative of data staging for potential exfiltration followed by an attempt to delete evidence or clear tracks.
This rule detects processes that load the 'rstrtmgr.dll' library and subsequently perform mass process termination (3 or more distinct processes in under 2 minutes, excluding 'explorer.exe'). This behavior is commonly associated with ransomware, such as DragonForce, which uses the Windows Restart Manager API to identify and forcefully close applications that are locking files they intend to encrypt.
Detects the ENCFORGE locker malware, associated with the JADEPUFFER campaign, which specifically targets AI/ML-related files such as model checkpoints, vector databases, and training data for the purpose of malicious encryption or destruction.
Detects the use of the native Windows utility cipher.exe with the /w flag executed from the command prompt. The /w switch instructs cipher to remove data from available unused disk space, which is a technique often used by threat actors to hinder forensic recovery of deleted files.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite free space on a volume to permanently delete data, a common technique for anti-forensics and data destruction.
Detects unauthorized attempts to modify, delete, or truncate backup configuration files and data directories associated with cPanel, WHM, and Plesk environments. This rule monitors for common file manipulation commands (e.g., rm, mv, truncate) targeting sensitive paths like /etc/acronis, /etc/cpanel/backups, and other backup-related directories, excluding actions performed by authorized service accounts.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects the creation of multiple or specific file locks that deviate from standard naming conventions, often associated with wiper malware attempting to overwrite files or fill disks by creating locking files as part of their destructive payload.
Detects potential database ransomware activity by correlating the usage of AES_ENCRYPT for record modification, followed by the dropping of tables and the insertion of ransom notes containing specific contact keywords (e.g., bitcoin, proton mail) within database queries or system logs.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects the use of the built-in Windows 'cipher.exe' utility with the '/w' flag, which is used to securely overwrite free space on a disk, a technique often used by adversaries for anti-forensics or data destruction to prevent file recovery. The rule specifically alerts on execution from command-line environments (cmd.exe) where the command output is redirected to null, often used to hide the progress or output of the wiping process.
Detects a 'force-push' operation in a Git repository where the pushed commit is not cryptographically signed. This behavior is often indicative of repository tampering, such as overwriting commit history to remove audit trails, hide malicious code injection, or facilitate unauthorized repository modifications.
Detects instances where a process running as 'root' modifies files within an Acronis-related directory. This specifically alerts when the modifying process is not identified as a known, authorized Acronis backup service, potentially indicating unauthorized tampering with backup archives or configuration files.
Page 4 of 19