Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
20
8
6
3
3
Contributors
15
9
5
2
2
Categories
20
13
12
9
6
Platforms
33
5
5
1
Products / Services
23
12
5
4
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
3
IDS Protocols
2
1
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects execution of the GigaWiper 'WipeCMain' functionality, characterized by specific command line indicators associated with a multi-pass disk wiping process. This behavior is indicative of destructive wiper malware attempting to render data on system drives irrecoverable.
Detects direct raw access to the primary physical disk device (PhysicalDrive0) on Windows systems. This behavior is often associated with ransomware or wiper malware attempting to overwrite the Master Boot Record (MBR) or partition table to render the system unbootable.
This rule detects attempts to directly access and modify raw disk devices, a technique commonly used by wiper malware like GigaWiper. It monitors for operations involving raw physical disk paths (e.g., \\.\PhysicalDrive) in conjunction with strings indicative of disk destructive routines such as partition removal, disk creation IOCTLs, or raw drive handle manipulation.
Detects the use of administrative utilities (takeown, icacls, del) to modify permissions on and subsequently delete critical Windows boot files (winload.exe, winload.efi, ntoskrnl.exe, bootmgr). This activity is associated with GigaWiper and is intended to render the target operating system unbootable.
Detects attempts by processes to gain raw read/write access to the physical disk (PhysicalDrive0), which is a common technique used by wiper malware to overwrite the Master Boot Record (MBR) and render the system unbootable.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
Detects Master Boot Record overwrite for disk wiping attacks
Detects C2 commands triggering disk wipe operations for destructive impact
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
This rule detects the delivery of a potential ransomware MBR (Master Boot Record) wiper payload via HTTP. It specifically looks for HTTP responses containing file data that starts with the byte sequence '55 AA' (which often indicates a boot sector or MBR) and also contains 'MZ' (the DOS executable signature), with a file size greater than 10,000 bytes. This combination suggests a malicious executable designed to overwrite the MBR, a common tactic used by certain types of ransomware or disk wipers.
Detects destructive Linux commands such as recursive root directory deletion (rm -rf /*) and random data disk wiping (dd if=/dev/urandom of=/dev/sdX). This behavior has been observed as payloads in indirect prompt injections targeting LLM agents to destroy host filesystems.
Detects the execution of the Windows 'diskpart' utility combined with the 'clean all' command. This command forcefully overwrites all partition data with zeroes and is utilized by destructive threats, such as Lotus Wiper, to irrevocably destroy logical volumes.
Cisco File Deletion
Sigma
See what files are being deleted from flash file systems
Detects the ZEROLOT wiper, a component reportedly used by the Sandworm group. This rule identifies specific artifacts related to its disk wiping functionality.
The following analytic detects suspicious raw access reads to the device disk partition of a host machine. It leverages Sysmon EventCode 9 logs to identify processes attempting to read or write to the boot sector, excluding legitimate system processes. This activity is significant as it is commonly associated with destructive actions by adversaries, such as wiping, encrypting, or overwriting the boot sector, as seen in attacks involving malware like HermeticWiper. If confirmed malicious, this behavior could lead to severe impacts, including system inoperability, data loss, or compromised boot integrity.
The following analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR). It leverages Sysmon EventCode 9 to identify processes attempting to read or write to the MBR sector, excluding legitimate system processes. This activity is significant because adversaries often target the MBR to wipe, encrypt, or overwrite it as part of their impact payload. If confirmed malicious, this could lead to system instability, data loss, or a complete system compromise, severely impacting the organization's operations.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
This YARA rule detects the IsaacWiper trojan by identifying specific byte patterns related to its functionality. The rule looks for two distinct code sections: one responsible for enumerating physical drives and another for corrupting drive data. The presence of both patterns indicates the likely presence of the IsaacWiper malware, which is known for its destructive disk wiping capabilities.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
Page 2 of 2