| elastic |
AWS EKS Events Deleted |
production |
2026-10-20 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-10-08 |
| elastic |
System Log File Deletion |
production |
2026-10-06 |
| elastic |
ESXi Host Logs Deleted with rm |
production |
2026-09-30 |
| elastic |
Suspicious Print Spooler File Deletion |
production |
2026-09-18 |
| elastic |
Delete Volume USN Journal with Fsutil |
production |
2026-09-18 |
| elastic |
WebServer Access Logs Deleted |
production |
2026-09-18 |
| elastic |
Potential Secure File Deletion via SDelete Utility |
production |
2026-09-18 |
| elastic |
Potential REMCOS Trojan Execution |
production |
2026-09-18 |
| elastic |
SSL Certificate Deletion |
production |
2026-09-18 |
| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
Process Execution Followed by Self-Deletion |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| splunk |
Windows RDP Cache File Deletion |
production |
2026-07-20 |
| splunk |
Windows Rdp AutomaticDestinations Deletion |
production |
2026-07-20 |
| splunk |
Linux High Frequency Of File Deletion In Etc Folder |
production |
2026-05-13 |
| splunk |
Clear Unallocated Sector Using Cipher App |
production |
2026-05-13 |
| splunk |
Linux Account Manipulation Of SSH Config and Keys |
production |
2026-05-13 |
| splunk |
Linux Deletion Of Cron Jobs |
production |
2026-05-13 |
| splunk |
Linux Deletion Of Init Daemon Script |
production |
2026-05-13 |
| splunk |
Linux Deletion Of Services |
production |
2026-05-13 |
| splunk |
Linux Deletion of SSL Certificate |
production |
2026-05-13 |
| splunk |
Linux High Frequency Of File Deletion In Boot Folder |
production |
2026-05-13 |
| splunk |
Linux Indicator Removal Service File Deletion |
production |
2026-05-13 |
| splunk |
Recursive Delete of Directory In Batch CMD |
production |
2026-05-13 |
| splunk |
Sdelete Application Execution |
production |
2026-05-13 |
| splunk |
Windows Default Rdp File Deletion |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Deletion |
production |
2026-05-13 |
| elastic |
Deprecated - Process Termination followed by Deletion |
deprecated |
2026-02-04 |
| sigma |
ADS Zone.Identifier Deleted By Uncommon Application |
test |
2025-07-04 |
| sigma |
Potential Secure Deletion with SDelete |
test |
2024-12-13 |
| sigma |
Potentially Suspicious Ping/Copy Command Combination |
test |
2024-03-06 |
| sigma |
File Deletion Via Del |
test |
2024-03-05 |
| sigma |
Suspicious Ping/Del Command Combination |
test |
2024-03-05 |
| sigma |
Prefetch File Deleted |
test |
2024-01-25 |
| sigma |
Greedy File Deletion Using Del |
test |
2023-09-11 |
| sigma |
ADS Zone.Identifier Deleted |
test |
2023-09-04 |
| sigma |
Directory Removal Via Rmdir |
test |
2023-03-07 |
| sigma |
File Deleted Via Sysinternals SDelete |
test |
2023-02-15 |
| sigma |
TeamViewer Log File Deleted |
test |
2023-02-15 |
| sigma |
Cisco File Deletion |
test |
2023-01-04 |
| sigma |
Backup Catalog Deleted |
test |
2022-12-25 |
| sigma |
File Deletion |
stable |
2022-09-15 |
| sigma |
Use Of Remove-Item to Delete File - ScriptBlock |
test |
2022-03-17 |