| elastic |
Potential Destructive AWS CLI Command Executed by GenAI Agent |
production |
2026-10-23 |
| splunk |
Linux DD File Overwrite |
production |
2026-10-02 |
| splunk |
Linux Auditd Dd File Overwrite |
production |
2026-10-02 |
| elastic |
AWS Lambda Function Deletion by Unusual User |
production |
2026-09-28 |
| elastic |
Anthropic Organization Deletion |
production |
2026-09-25 |
| elastic |
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action |
production |
2026-09-25 |
| splunk |
O365 Email Send and Hard Delete Exfiltration Behavior |
production |
2026-09-23 |
| splunk |
O365 Email Receive and Hard Delete Takeover Behavior |
production |
2026-09-23 |
| splunk |
O365 Email Password and Payroll Compromise Behavior |
production |
2026-09-23 |
| splunk |
O365 Email Send Attachments Excessive Volume |
production |
2026-09-23 |
| splunk |
Common Ransomware Extensions |
production |
2026-09-22 |
| elastic |
Azure Automation Runbook Deleted |
production |
2026-09-18 |
| elastic |
Azure Event Hub Deleted |
production |
2026-09-18 |
| elastic |
Azure Compute Snapshot Deletion by Unusual User and Resource Group |
production |
2026-09-18 |
| elastic |
Azure Compute Snapshot Deletions by User |
production |
2026-09-18 |
| elastic |
Azure Storage Account Deletion by Unusual User |
production |
2026-09-18 |
| elastic |
Azure Storage Account Deletions by User |
production |
2026-09-18 |
| elastic |
Azure Resource Group Deleted |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Network Deletion |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Deletion |
production |
2026-09-18 |
| elastic |
GitHub Repository Deleted |
production |
2026-09-18 |
| elastic |
High Number of Closed Pull Requests by User |
production |
2026-09-18 |
| elastic |
Several Failed Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
High Number of Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Security Compliance Unusual Volume of File Deletion |
production |
2026-09-18 |
| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
Potential Ransomware Note File Dropped via SMB |
production |
2026-09-18 |
| elastic |
Suspicious File Renamed via SMB |
production |
2026-09-18 |
| elastic |
Potential System Tampering via File Modification |
production |
2026-09-18 |
| elastic |
Potential Ransomware Behavior - Note Files by System |
production |
2026-09-18 |
| elastic |
Backup Deletion with Wbadmin |
production |
2026-09-18 |
| elastic |
First-Time Destructive MongoDB Command from a Client IP |
production |
2026-09-18 |
| elastic |
Third-party Backup Files Deleted via Unexpected Process |
production |
2026-09-18 |
| elastic |
Potential Secure File Deletion via SDelete Utility |
production |
2026-09-18 |
| elastic |
AWS SQS Queue Purge |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Group Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Stream Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Access Removed |
production |
2026-09-18 |
| elastic |
AWS EFS File System Deleted |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
AWS KMS Imported Key Material Deleted |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deleted |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deletion Protection Disabled |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Deleted |
production |
2026-09-18 |
| elastic |
Potential AWS S3 Bucket Ransomware Note Uploaded |
production |
2026-09-18 |
| elastic |
SSL Certificate Deletion |
production |
2026-09-18 |
| elastic |
AWS S3 Unauthenticated Bucket Access by Rare Source |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Expiration Lifecycle Configuration Added |
production |
2026-09-18 |
| elastic |
AWS Account Closed |
production |
2026-09-18 |
| elastic |
Successful AMQP Multi-Queue Purge Burst |
production |
2026-09-18 |
| splunk |
Linux Data Destruction Command |
production |
2026-09-01 |
| splunk |
Windows File Without Extension In Critical Folder |
production |
2026-07-27 |
| splunk |
Common Ransomware Notes |
production |
2026-07-02 |
| sigma |
Renamed Sysinternals Sdelete Execution |
test |
2026-06-29 |
| splunk |
Linux Deletion of SSL Certificate |
production |
2026-05-13 |
| splunk |
AWS Bedrock Delete Knowledge Base |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Remove Organization |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Repository Archived |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Repository Deleted |
production |
2026-05-13 |
| splunk |
GitHub Organizations Repository Archived |
production |
2026-05-13 |
| splunk |
GitHub Organizations Repository Deleted |
production |
2026-05-13 |
| splunk |
O365 Email Hard Delete Excessive Volume |
production |
2026-05-13 |
| splunk |
O365 Email Send and Hard Delete Suspicious Behavior |
production |
2026-05-13 |
| splunk |
Excessive File Deletion In WinDefender Folder |
production |
2026-05-13 |
| splunk |
Linux Account Manipulation Of SSH Config and Keys |
production |
2026-05-13 |
| splunk |
Linux Auditd Data Destruction Command |
production |
2026-05-13 |
| splunk |
Linux Auditd Shred Overwrite Command |
production |
2026-05-13 |
| splunk |
Linux Deleting Critical Directory Using RM Command |
production |
2026-05-13 |
| splunk |
Linux Deletion Of Cron Jobs |
production |
2026-05-13 |
| splunk |
Linux Deletion Of Init Daemon Script |
production |
2026-05-13 |
| splunk |
Linux Deletion Of Services |
production |
2026-05-13 |
| splunk |
Linux High Frequency Of File Deletion In Boot Folder |
production |
2026-05-13 |
| splunk |
Linux High Frequency Of File Deletion In Etc Folder |
production |
2026-05-13 |
| splunk |
Linux Shred Overwrite Command |
production |
2026-05-13 |
| splunk |
Sdelete Application Execution |
production |
2026-05-13 |
| splunk |
Windows Data Destruction Recursive Exec Files Deletion |
production |
2026-05-13 |
| splunk |
Windows Disable Memory Crash Dump |
production |
2026-05-13 |
| splunk |
Windows High File Deletion Frequency |
production |
2026-05-13 |
| splunk |
Detect DNS Query to Decommissioned S3 Bucket |
experimental |
2026-05-13 |
| splunk |
Detect Web Access to Decommissioned S3 Bucket |
experimental |
2026-05-13 |
| sigma |
MSSQL Destructive Query |
experimental |
2025-06-04 |
| sigma |
Potential Secure Deletion with SDelete |
test |
2024-12-13 |
| sigma |
Fsutil Suspicious Invocation |
stable |
2023-09-09 |
| sigma |
Potential File Overwrite Via Sysinternals SDelete |
test |
2023-02-28 |
| sigma |
Deleted Data Overwritten Via Cipher.EXE |
test |
2023-02-21 |
| sigma |
Potential BlackByte Ransomware Activity |
test |
2023-02-08 |
| sigma |
Azure Device or Configuration Modified or Deleted |
test |
2022-10-09 |
| sigma |
Microsoft 365 - Unusual Volume of File Deletion |
test |
2022-10-09 |
| sigma |
AWS EFS Fileshare Mount Modified or Deleted |
test |
2022-10-09 |
| sigma |
AWS EKS Cluster Created or Deleted |
test |
2022-10-09 |
| sigma |
Azure Kubernetes Cluster Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Container Registry Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Service Account Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Secret or Config Object Access |
test |
2022-08-23 |
| sigma |
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Sensitive Role Access |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Network Policy Change |
test |
2022-08-23 |
| sigma |
DD File Overwrite |
test |
2022-07-07 |
| sigma |
Overwriting the File with Dev Zero or Null |
stable |
2019-10-23 |
| sentinel |
Sdelete deployed via GPO and run recursively (ASIM Version) |
Scheduled |
— |
| sentinel |
Potential re-named sdelete usage (ASIM Version) |
Scheduled |
— |