| elastic |
M365 Exchange MFA Notification Email Deleted or Moved |
production |
2026-10-20 |
| elastic |
AWS EKS Events Deleted |
production |
2026-10-20 |
| elastic |
Sensitive Audit Policy Sub-Category Disabled |
production |
2026-10-19 |
| sigma |
Exchange PowerShell Cmdlet History Deleted |
test |
2026-10-13 |
| sigma |
ETW Trace Evasion Activity |
test |
2026-10-12 |
| sigma |
Disable of ETW Trace - Powershell |
test |
2026-10-12 |
| elastic |
OpenAI ChatGPT Enterprise Workspace Log File Deleted |
production |
2026-10-09 |
| splunk |
USN Journal Deletion |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Excessive Conversation Deletion |
production |
2026-10-09 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-10-08 |
| elastic |
System Log File Deletion |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Memory Deleted |
production |
2026-10-06 |
| elastic |
Timestomping using Touch Command |
production |
2026-10-05 |
| elastic |
ESXi Host Logs Deleted with rm |
production |
2026-09-30 |
| elastic |
Anthropic Excessive Chat Deletion |
production |
2026-09-25 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Tampering of Shell Command-Line History |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Configuration Deletion |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Expiration Lifecycle Configuration Added |
production |
2026-09-18 |
| elastic |
AWS SES Email Identity Verified Then Deleted |
production |
2026-09-18 |
| elastic |
Azure AKS Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Shell Command-Line History Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Attempt to Clear Kernel Ring Buffer |
production |
2026-09-18 |
| elastic |
ESXI Timestomping using Touch Command |
production |
2026-09-18 |
| elastic |
Process Execution Followed by Self-Deletion |
production |
2026-09-18 |
| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Shell History Clearing via Environment Variables |
production |
2026-09-18 |
| elastic |
SSL Certificate Deletion |
production |
2026-09-18 |
| elastic |
Linux User or Group Deletion |
production |
2026-09-18 |
| elastic |
Potential REMCOS Trojan Execution |
production |
2026-09-18 |
| elastic |
Clearing Windows Console History |
production |
2026-09-18 |
| elastic |
Clearing Windows Event Logs |
production |
2026-09-18 |
| elastic |
Windows Event Logs Cleared |
production |
2026-09-18 |
| elastic |
Delete Volume USN Journal with Fsutil |
production |
2026-09-18 |
| elastic |
Disable Windows Event and Security Logs Using Built-in Tools |
production |
2026-09-18 |
| elastic |
Potential Secure File Deletion via SDelete Utility |
production |
2026-09-18 |
| elastic |
Potential Timestomp in Executable Files |
production |
2026-09-18 |
| elastic |
Suspicious Print Spooler File Deletion |
production |
2026-09-18 |
| elastic |
WebServer Access Logs Deleted |
production |
2026-09-18 |
| elastic |
AWS Audit or Security Service Tampering via CLI |
production |
2026-09-14 |
| splunk |
ESXi Audit Tampering |
production |
2026-09-08 |
| splunk |
Windows Indicator Removal Via Rmdir |
production |
2026-08-14 |
| splunk |
Process Deleting Its Process File Path |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Message Suppression |
production |
2026-05-13 |
| splunk |
Linux Indicator Removal Clear Cache |
production |
2026-05-13 |
| splunk |
MacOS Log Removal |
production |
2026-05-13 |
| splunk |
Fsutil Zeroing File |
production |
2026-05-13 |
| elastic |
Deprecated - Process Termination followed by Deletion |
deprecated |
2026-02-04 |
| sigma |
Filter Driver Unloaded Via Fltmc.EXE |
test |
2025-10-07 |
| sigma |
IIS WebServer Log Deletion via CommandLine Utilities |
experimental |
2025-09-02 |
| sigma |
Kubernetes Events Deleted |
test |
2024-03-26 |
| sigma |
DLL Load By System Process From Suspicious Locations |
test |
2023-09-18 |
| sigma |
Fsutil Suspicious Invocation |
stable |
2023-09-09 |
| sigma |
Linux Package Uninstall |
test |
2023-03-09 |
| sigma |
Tomcat WebServer Logs Deleted |
test |
2023-02-16 |
| sigma |
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE |
test |
2023-02-15 |
| sigma |
PowerShell Console History Logs Deleted |
test |
2023-02-15 |
| sigma |
IIS WebServer Access Logs Deleted |
test |
2023-02-15 |
| sigma |
EventLog EVTX File Deleted |
test |
2023-02-15 |
| sigma |
Sysmon Driver Unloaded Via Fltmc.EXE |
test |
2023-02-13 |
| sigma |
Terminal Server Client Connection History Cleared - Registry |
test |
2023-02-08 |
| sigma |
Remove Exported Mailbox from Exchange Webserver |
test |
2023-01-23 |
| sigma |
SES Identity Has Been Deleted |
test |
2022-12-28 |
| sigma |
Clearing Windows Console History |
test |
2022-12-25 |
| sigma |
Shadow Copies Deletion Using Operating Systems Utilities |
stable |
2022-11-03 |