Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Read More

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

Read More

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

Read More

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Read More

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

Read More

Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence

Read More

Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

Read More

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Read More

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

Read More

Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence

Read More

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Read More

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Read More