Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
390 detections
Filters
Last updated
All Time
Detection languages
150
87
71
26
16
Contributors
58
55
51
39
39
Categories
189
94
84
82
59
Platforms
185
68
60
30
27
Products / Services
73
57
50
43
31
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
IDS Protocols
4
Windows Multiple User Account Deletions
Cortex XDR
Detects five or more distinct Windows user-account deletion events (Event ID 4726) performed by the same actor on the same host within a one-hour time window, which may indicate unauthorized account access removal or malicious impact activity.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule detects the file deletion activities on azure blob storage accounts
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.
This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule detects unsuccessful attempts by human users to delete objects from Google Cloud Storage buckets that are protected by bucket-level retention policies. By filtering out service accounts, the rule specifically focuses on non-automated, human-initiated actions that violate data retention requirements.
This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise.
This rule detects attempts to sabotage or brick Linux systems by monitoring for modifications or overwrites of critical system binaries responsible for reboot, shutdown, and power management, including 'reboot', 'shutdown', 'halt', 'poweroff', 'systemctl', and 'telinit'. It specifically identifies activity associated with the 'ELFOOD' header-corruption marker, a technique linked to the Tengu malware strain which prevents legitimate system reboots to maintain persistence and impede remediation efforts.
Generic rule content from file: TOKYOCORE Wiper: Raw MBR Overwrite via \\.\PhysicalDrive0
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Page 6 of 19