Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
391 detections
Filters
Last updated
All Time
Detection languages
151
87
71
26
16
Contributors
58
55
51
39
39
Categories
190
94
84
83
59
Platforms
185
69
60
30
27
Products / Services
73
58
50
43
31
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
4
IDS Protocols
4
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the restart action performed on a specific Azure container group named 'fr33m3' within the 'bialystok-rg' resource group. This monitors for lifecycle management activities that could be indicative of service manipulation or persistence resets.
Detects the execution of the NoEscape ransomware DISKWRITER component by matching known file hashes associated with the wiper malware.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
Detects execution of the GigaWiper 'WipeCMain' functionality, characterized by specific command line indicators associated with a multi-pass disk wiping process. This behavior is indicative of destructive wiper malware attempting to render data on system drives irrecoverable.
Detects direct raw access to the primary physical disk device (PhysicalDrive0) on Windows systems. This behavior is often associated with ransomware or wiper malware attempting to overwrite the Master Boot Record (MBR) or partition table to render the system unbootable.
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
Detects the use of Microsoft lookalike domains for command and control (C2) communication in the context of wiper malware.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Detects processes that execute commands involving SQL database operations, specifically those related to AES encryption functions or table management (create/drop operations) on configurations. This activity is often associated with potential database manipulation or data destruction attempts by an attacker.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
Detects command-line execution of database drop operations combined with the disabling of foreign key constraints, which is indicative of malicious database manipulation or automated data destruction attempts.
Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
Detects the deletion of directory service objects such as users, groups, organizational units, computers, or trusted domains. This is identified via Windows Security Event ID 5141, which tracks when a directory object is deleted.
Detects the execution of common Windows utilities (diskpart, format, cipher, sdelete, eraser) when used with flags indicative of data destruction or disk wiping behavior. This rule monitors for process creations involving commands designed to irrecoverably erase data or wipe drive contents.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
Page 7 of 19