| splunk |
Deleting Shadow Copies |
production |
2026-10-09 |
| elastic |
AWS S3 Object Versioning Suspended |
production |
2026-10-06 |
| splunk |
Delete ShadowCopy With PowerShell |
production |
2026-10-02 |
| splunk |
BCDEdit Failure Recovery Modification |
production |
2026-10-02 |
| splunk |
Windows WMIC Shadowcopy Delete |
production |
2026-10-02 |
| splunk |
WBAdmin Delete System Backups |
production |
2026-10-02 |
| splunk |
Resize ShadowStorage volume |
production |
2026-10-02 |
| splunk |
Disabling SystemRestore In Registry |
production |
2026-10-02 |
| elastic |
ESXi Virtual Machine Snapshot Removed |
production |
2026-09-30 |
| elastic |
AWS Backup Recovery Point Deleted by Unusual User |
production |
2026-09-28 |
| elastic |
AWS EC2 EBS Snapshot Access Removed |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket MFA Delete Disabled |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Configuration Deletion |
production |
2026-09-18 |
| elastic |
AWS Backup Vault Deleted or Vault Lock Removed |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Deleted |
production |
2026-09-18 |
| elastic |
Volume Shadow Copy Deletion via WMIC |
production |
2026-09-18 |
| elastic |
Volume Shadow Copy Deletion via PowerShell |
production |
2026-09-18 |
| elastic |
Volume Shadow Copy Deleted or Resized via VssAdmin |
production |
2026-09-18 |
| elastic |
Potential Ransomware Note File Dropped via SMB |
production |
2026-09-18 |
| elastic |
Suspicious File Renamed via SMB |
production |
2026-09-18 |
| elastic |
Modification of Boot Configuration |
production |
2026-09-18 |
| elastic |
Potential System Tampering via File Modification |
production |
2026-09-18 |
| elastic |
Backup Deletion with Wbadmin |
production |
2026-09-18 |
| elastic |
Third-party Backup Files Deleted via Unexpected Process |
production |
2026-09-18 |
| elastic |
Azure Resource Group Deleted |
production |
2026-09-18 |
| elastic |
Azure Compute Snapshot Deletions by User |
production |
2026-09-18 |
| elastic |
Azure Compute Snapshot Deletion by Unusual User and Resource Group |
production |
2026-09-18 |
| elastic |
Azure Compute Restore Point Collections Deleted |
production |
2026-09-18 |
| elastic |
Azure Compute Restore Point Collection Deleted by Unusual User |
production |
2026-09-18 |
| sigma |
Suspicious Volume Shadow Copy Vssapi.dll Load |
test |
2026-08-27 |
| sigma |
Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load |
test |
2026-08-27 |
| sigma |
Amsi.DLL Load By Uncommon Process |
test |
2026-06-29 |
| splunk |
Windows Cisco Secure Endpoint Related Service Stopped |
production |
2026-05-13 |
| splunk |
ASL AWS Disable Bucket Versioning |
production |
2026-05-13 |
| splunk |
AWS Disable Bucket Versioning |
production |
2026-05-13 |
| splunk |
Bcdedit Command Back To Normal Mode Boot |
production |
2026-05-13 |
| splunk |
Change To Safe Mode With Network Config |
production |
2026-05-13 |
| splunk |
Prevent Automatic Repair Mode using Bcdedit |
production |
2026-05-13 |
| splunk |
Windows BitLocker Suspicious Command Usage |
production |
2026-05-13 |
| splunk |
Windows Security And Backup Services Stop |
production |
2026-05-13 |
| splunk |
Windows Suspicious File in EFI Volume |
production |
2026-05-13 |
| splunk |
Windows WBAdmin File Recovery From Backup |
production |
2026-05-13 |
| sigma |
System Restore Registry Modification via CommandLine |
experimental |
2026-03-11 |
| sigma |
Potential Dtrack RAT Activity |
stable |
2025-11-03 |
| sigma |
WannaCry Ransomware Activity |
test |
2025-10-18 |
| sigma |
Windows Recovery Environment Disabled Via Reagentc |
experimental |
2025-07-31 |
| sigma |
Suspicious Volume Shadow Copy VSS_PS.dll Load |
test |
2025-07-11 |
| sigma |
Cisco Modify Configuration |
test |
2025-04-28 |
| sigma |
Time Machine Backup Deletion Attempt Via Tmutil - MacOS |
test |
2024-05-29 |
| sigma |
New File Exclusion Added To Time Machine Via Tmutil - MacOS |
test |
2024-05-29 |
| sigma |
Time Machine Backup Disabled Via Tmutil - MacOS |
test |
2024-05-29 |
| sigma |
All Backups Deleted Via Wbadmin.EXE |
test |
2024-05-10 |
| sigma |
File Recovery From Backup Via Wbadmin.EXE |
test |
2024-05-10 |
| sigma |
Windows Backup Deleted Via Wbadmin.EXE |
test |
2024-05-10 |
| sigma |
Sensitive File Access Via Volume Shadow Copy Backup |
test |
2024-01-18 |
| sigma |
AWS S3 Bucket Versioning Disable |
test |
2023-10-28 |
| sigma |
Delete Volume Shadow Copies Via WMI With PowerShell |
stable |
2023-10-27 |
| sigma |
Registry Disable System Restore |
test |
2023-08-17 |
| sigma |
New Root or CA or AuthRoot Certificate to Store |
test |
2023-08-17 |
| sigma |
Copy From VolumeShadowCopy Via Cmd.EXE |
test |
2023-03-07 |
| sigma |
Boot Configuration Tampering Via Bcdedit.EXE |
stable |
2023-02-15 |
| sigma |
Backup Files Deleted |
test |
2023-02-15 |
| sigma |
Potential Maze Ransomware Activity |
test |
2023-02-13 |
| sigma |
Deletion of Volume Shadow Copies via WMI with PowerShell |
test |
2022-12-30 |
| sigma |
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script |
test |
2022-12-02 |
| sigma |
Shadow Copies Deletion Using Operating Systems Utilities |
stable |
2022-11-03 |