Sponsor of the Day:
Jerkmate
https://detection.fyi/sigmahq/sigma/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted/
Azure Virtual Network Device Modified or Deleted | Detection.FYI
Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual …
deleted detection fyiazure virtualnetwork devicemodified
https://detection.fyi/sigmahq/sigma/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted/
Kubernetes Secrets Modified or Deleted | Detection.FYI
Detects when Kubernetes Secrets are Modified or Deleted.
deleted detection fyikubernetes secretsmodified
https://detection.fyi/sigmahq/sigma/windows/file/file_delete/file_delete_win_delete_prefetch/
Prefetch File Deleted | Detection.FYI
Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
deleted detection fyiprefetchfile
https://detection.fyi/sigmahq/sigma/application/kubernetes/audit/kubernetes_audit_events_deleted/
Kubernetes Events Deleted | Detection.FYI
Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
deleted detection fyikubernetesevents
https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted/
AWS EFS Fileshare Modified or Deleted | Detection.FYI
Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary...
deleted detection fyiawsefsfilesharemodified
https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/
Deleted Data Overwritten Via Cipher.EXE | Detection.FYI
Detects usage of the
exe detection fyideleted dataoverwrittenviacipher