Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
11
5
4
2
2
Contributors
5
3
3
2
2
Categories
7
7
6
4
4
Platforms
12
6
6
4
3
Products / Services
6
5
2
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects the creation of multiple or specific file locks that deviate from standard naming conventions, often associated with wiper malware attempting to overwrite files or fill disks by creating locking files as part of their destructive payload.
Detects direct raw access to the primary physical disk device (PhysicalDrive0) on Windows systems. This behavior is often associated with ransomware or wiper malware attempting to overwrite the Master Boot Record (MBR) or partition table to render the system unbootable.
Detects the execution of common Windows utilities (diskpart, format, cipher, sdelete, eraser) when used with flags indicative of data destruction or disk wiping behavior. This rule monitors for process creations involving commands designed to irrecoverably erase data or wipe drive contents.
Detects use of dd command to wipe disk content for data destruction
Detects the execution of common Windows utilities (diskpart, format, cipher, sdelete, eraser) when used with flags indicative of data destruction or disk wiping behavior. This rule monitors for process creations involving commands designed to irrecoverably erase data or wipe drive contents.
This rule detects the execution of the 'dd if=/dev/zero' command over an SSH connection. This command is commonly used to wipe disk content by overwriting it with zeros, which can be an indicator of malicious activity aimed at destroying data or hindering forensic analysis. The rule specifically looks for this string within TCP traffic directed to port 22 (SSH).
Detects C2 commands triggering disk wipe operations for destructive impact
Detects raw disk volume access used to bypass file system security controls
This rule detects a high volume of TCP traffic on port 445 (SMB) directed to the home network, specifically looking for the SMB protocol signature. The threshold of 500 connections within 30 seconds from a single source IP suggests an attempt at mass file deletion or disk wiping activity on network shares, often associated with ransomware or destructive malware.
Detects the execution of the Shai-Hulud malware's dead-man switch mechanism, specifically the 'gh-token-monitor' service or its destructive wipe payload 'rm -rf ~/'.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
Cisco File Deletion
Sigma
See what files are being deleted from flash file systems
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
Detects the ZEROLOT wiper, a component reportedly used by the Sandworm group. This rule identifies specific artifacts related to its disk wiping functionality.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query
Identify accounts that have logged on to affected endpoints.
Check for specific alerts.
Check for specific alerts.
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
Page 1 of 2