| sigma |
Suspicious Windows Service Tampering |
test |
2026-10-17 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-10-09 |
| splunk |
Ollama Abnormal Service Crash Availability Attack |
deprecated |
2026-10-09 |
| splunk |
Linux Magic SysRq Key Abuse |
production |
2026-10-02 |
| splunk |
Linux Auditd Stop Services |
production |
2026-10-02 |
| splunk |
Windows Service Stop Attempt |
production |
2026-10-02 |
| elastic |
ESXi Virtual Machine Process Killed |
production |
2026-09-30 |
| elastic |
AWS Lambda Function Deletion by Unusual User |
production |
2026-09-28 |
| elastic |
High Number of Process and/or Service Terminations |
production |
2026-09-18 |
| elastic |
Azure Storage Account Deletion by Unusual User |
production |
2026-09-18 |
| elastic |
Azure Storage Account Deletions by User |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Pods Deleted |
production |
2026-09-18 |
| elastic |
Suspicious Termination of ESXI Process |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Application |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Application |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Deletion |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Subscription Deletion |
production |
2026-09-18 |
| elastic |
Elastic Agent Service Terminated |
production |
2026-09-18 |
| elastic |
Azure Resource Group Deleted |
production |
2026-09-18 |
| elastic |
AWS EventBridge Rule Disabled or Deleted |
production |
2026-09-18 |
| elastic |
High Number of Process Terminations |
production |
2026-09-18 |
| elastic |
Process Killing Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Decline in host-based traffic |
production |
2026-09-18 |
| splunk |
Windows Set Account Password Policy To Unlimited Via Net |
production |
2026-08-11 |
| splunk |
Windows Service Stop By Deletion |
production |
2026-05-13 |
| splunk |
Excessive Attempt To Disable Services |
production |
2026-05-13 |
| splunk |
Linux Auditd Auditd Service Stop |
production |
2026-05-13 |
| splunk |
Linux Auditd Osquery Service Stop |
production |
2026-05-13 |
| splunk |
Linux Auditd Sysmon Service Stop |
production |
2026-05-13 |
| splunk |
Linux Disable Services |
production |
2026-05-13 |
| splunk |
Linux Stop Services |
production |
2026-05-13 |
| splunk |
Windows Excessive Service Stop Attempt |
production |
2026-05-13 |
| splunk |
Windows Processes Killed By Industroyer2 Malware |
production |
2026-05-13 |
| splunk |
Windows Security Account Manager Stopped |
production |
2026-05-13 |
| splunk |
Windows Service Deletion In Registry |
production |
2026-05-13 |
| splunk |
Windows Service Stop Win Updates |
production |
2026-05-13 |
| sigma |
Azure Application Deleted |
test |
2026-04-30 |
| sigma |
Delete Important Scheduled Task |
test |
2026-03-11 |
| sigma |
Important Scheduled Task Deleted or Disabled |
test |
2026-03-11 |
| sigma |
Disable Important Scheduled Task |
test |
2026-03-11 |
| elastic |
Deprecated - AWS RDS Instance/Cluster Stoppage |
deprecated |
2026-01-16 |
| sigma |
Potential Abuse of Linux Magic System Request Key |
experimental |
2025-05-23 |
| sigma |
Disable Or Stop Services |
test |
2025-03-18 |
| sigma |
Process Terminated Via Taskkill |
test |
2024-10-06 |
| sigma |
Stop Windows Service Via Sc.EXE |
test |
2024-01-18 |
| sigma |
Stop Windows Service Via Net.EXE |
test |
2023-03-05 |
| sigma |
Stop Windows Service Via PowerShell Stop-Service |
test |
2023-03-05 |
| sigma |
Application Uninstalled |
test |
2022-09-17 |
| sigma |
Delete All Scheduled Tasks |
test |
2022-09-09 |
| sigma |
Azure Kubernetes Cluster Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Container Registry Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Service Account Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Secret or Config Object Access |
test |
2022-08-23 |
| sigma |
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Sensitive Role Access |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Network Policy Change |
test |
2022-08-23 |
| sentinel |
Workspace deletion activity from an infected device |
Scheduled |
— |