Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
10
3
2
1
1
Contributors
3
2
2
2
2
Categories
5
5
4
3
3
Platforms
9
4
4
2
1
Products / Services
4
4
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects specific Android device admin command sequences that indicate attempts to establish persistent access by hardening the device against removal (e.g., enabling uninstall protection, setting device admin passwords, disabling biometrics) or destructive actions like performing a factory reset or self-uninstallation.
Detects the use of reg.exe to modify a Windows Run registry key to execute a destructive 'format C:' command upon system startup, indicative of wiper-style malware activity.
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects Master Boot Record overwrite for disk wiping attacks
Detects C2 commands triggering disk wipe operations for destructive impact
This rule detects potential command and control (C2) communication related to disk wiping activities. It specifically looks for the keywords "wipe" and "disk" (case-insensitive) within 50 bytes of each other in TCP traffic flowing from the server to the client. This pattern suggests a C2 server instructing a compromised client to perform disk wiping, which aligns with the MITRE ATT&CK technique T1561 (Disk Wipe) under the Impact tactic.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
This detection identifies activity associated with the Lotus Wiper destructive malware campaign, including its orchestration scripts, staging artifacts, and destructive behaviors.
The detection focuses on:
Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\)
Use of batch scripts such as OhSyncNow.bat and notesreg.bat
Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe)
System-level destructive actions including:
Disk wiping via diskpart clean all
File destruction using robocopy /MIR and fsutil file createnew
Network disruption via netsh interface disable
Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount)
Service tampering (e.g., UI0Detect stop/disable)
This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
The detection focuses on:
Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\)
Use of batch scripts such as OhSyncNow.bat and notesreg.bat
Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe)
System-level destructive actions including:
Disk wiping via diskpart clean all
File destruction using robocopy /MIR and fsutil file createnew
Network disruption via netsh interface disable
Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount)
Service tampering (e.g., UI0Detect stop/disable)
This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
'This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.'
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects the use of the tool cipher.exe to delete indicators of malicious activity right before encrypting a drive.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects the use of the tool cipher.exe to delete indicators of malicious activity right before encrypting a drive.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
This rule detects the Linux_Trojan_AcidRain malware by identifying specific byte patterns associated with its destructive capabilities. The rule looks for functions related to destroying files using ioctls, overwriting files, and redundant reboot attempts, indicating the presence of the AcidRain wiper malware.
This YARA rule detects the IsaacWiper trojan by identifying specific byte patterns related to its functionality. The rule looks for two distinct code sections: one responsible for enumerating physical drives and another for corrupting drive data. The presence of both patterns indicates the likely presence of the IsaacWiper malware, which is known for its destructive disk wiping capabilities.