Ankit Mehta (@Secvyn) | detections.ai

ZEROLOT Wiper Mass File Deletion via PowerShell or cmd.exe (T1485)

KQL

This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.

Ankit Mehta@Secvyn

Detections.ai Community

3 months ago

002

NTFS Alternate Data Stream (ADS) Execution Abuse - T1564.004

KQL

Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.

Ankit Mehta@Secvyn

Detections.ai Community

3 months ago

002

LNK Shortcut Abuse - Startup Persistence or Suspicious Execution via Downloads/Temp

KQL

This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.