Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
20
8
6
3
3
Contributors
15
9
5
2
2
Categories
20
13
12
9
6
Platforms
33
5
5
1
Products / Services
23
12
5
4
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
3
IDS Protocols
2
1
Detects command-line indicators associated with destructive disk-wiping activity, specifically targeting disk structure corruption to render systems unbootable. This rule monitors for unauthorized use of the Windows 'diskpart' utility, direct raw physical drive access, and specific file system utility commands (fsutil) frequently observed in wipers attributed to APT44 (Sandworm).
Detects malicious command-line activity associated with the XHOPELESS v1.0 wiper, specifically targeting firmware/BIOS/UEFI integrity. The detection covers WMI-based corruption of BIOS attributes, abuse of OEM-specific BIOS management namespaces, execution of legitimate firmware update tools with suspicious flags, modification of registry keys intended to disable firmware updates, and interaction with specific UEFI NVRAM GUIDs.
Detects attempts to tamper with or destroy Windows Boot Configuration Data (BCD) using bcdedit.exe to weaken system security policies or registry-based deletion of the BCD store to inhibit system boot and recovery.
Detects the use of the Windows 'diskpart' utility combined with a script or command execution containing 'clean all', which performs a destructive multi-pass overwrite of disk data structures to render it irrecoverable. This behavior is typically associated with malicious data destruction or wiping activities.
Detects the use of 'bootsect.exe' with parameters specifically designed to overwrite the Master Boot Record (MBR) and the targeting or modification of 'winload.efi', which is indicative of destructive boot-level attacks or bootkit deployment attempts.
Detects the use of reg.exe to modify a Windows Run registry key to execute a destructive 'format C:' command upon system startup, indicative of wiper-style malware activity.
Detects unauthorized write or modification access to core Windows boot-related files such as bootmgr, winload.efi, and the BCD store. This activity is indicative of destructive wiper malware attempting to render the operating system unbootable to prevent recovery, a technique observed in the TOKYOCORE wiper campaign.
Generic rule content from file: TOKYOCORE Wiper Clearing UEFI Secure Boot Keys via PowerShell
Generic rule content from file: TOKYOCORE Wiper: Raw MBR Overwrite via \\.\PhysicalDrive0
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects the execution of the NoEscape ransomware DISKWRITER component by matching known file hashes associated with the wiper malware.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Page 1 of 2