Linux Auditd Dd File Overwrite
Data Destruction
Impact
Linux Auditd Shred Overwrite Command
Data Destruction
Linux Auditd Auditd Service Stop
Service Stop
Linux Auditd Data Destruction Command
Data Destruction
Linux Auditd Stop Services
Service Stop
Linux Auditd Sysmon Service Stop
Service Stop
Linux Auditd Osquery Service Stop
Service Stop
Known Services Killed by Ransomware
Inhibit System Recovery
Detect Port Security Violation
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Windows DiskCryptor Usage
Data Encrypted for Impact
Disabling Net User Account
Account Access Removal
Deleting Shadow Copies
Inhibit System Recovery
Deleting Of Net Users
Account Access Removal
Detect ARP Poisoning
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Excessive Service Stop Attempt
Service Stop
Excessive Attempt To Disable Services
Service Stop
BCDEdit Failure Recovery Modification
Inhibit System Recovery
Detect Rogue DHCP Server
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle
Detect Traffic Mirroring
Hardware Additions, Automated Exfiltration, Network Denial of Service, Traffic Duplication
High Process Termination Frequency
Data Encrypted for Impact
Splunk Unauthenticated DoS via Null Pointer References
Endpoint Denial of Service
Splunk DoS via POST Request Datamodel Endpoint
Endpoint Denial of Service
Linux DD File Overwrite
Data Destruction
Splunk ES DoS Through Investigation Attachments
Endpoint Denial of Service
Splunk DoS Using Malformed SAML Request
Network Denial of Service
AWS Detect Users creating keys with encrypt policy without MFA
Data Encrypted for Impact
Modification Of Wallpaper
Defacement
Windows Raw Access To Disk Volume Partition
Disk Structure Wipe, Disk Wipe
Windows Raw Access To Disk Volume Partition
Disk Structure Wipe, Disk Wipe
Windows System Reboot CommandLine
System Shutdown/Reboot
Windows Valid Account With Never Expires Password
Service Stop
Splunk DoS via Malformed S2S Request
Network Denial of Service
Splunk Endpoint Denial of Service DoS Zip Bomb
Endpoint Denial of Service
Linux Data Destruction Command
Data Destruction
Common Ransomware Extensions
Data Destruction
Change To Safe Mode With Network Config
Inhibit System Recovery
Ransomware Notes bulk creation
Data Encrypted for Impact
Splunk ES DoS Investigations Manager via Investigation Creation
Endpoint Denial of Service
Splunk DOS via printf search function
Application or System Exploitation
Linux Disable Services
Service Stop
AWS Disable Bucket Versioning
Inhibit System Recovery
Windows Data Destruction Recursive Exec Files Deletion
Data Destruction
Linux Account Manipulation Of SSH Config and Keys
Data Destruction, File Deletion, Indicator Removal
Delete ShadowCopy With PowerShell
Inhibit System Recovery
Excessive Usage Of Net App
Account Access Removal
Sdelete Application Execution
Data Destruction, File Deletion, Indicator Removal
Disabling SystemRestore In Registry
Inhibit System Recovery
Bcdedit Command Back To Normal Mode Boot
Inhibit System Recovery
Linux Shred Overwrite Command
Data Destruction
Common Ransomware Notes
Data Destruction
Windows System LogOff Commandline
System Shutdown/Reboot
Windows File Without Extension In Critical Folder
Data Destruction
Linux Deletion Of Cron Jobs
Data Destruction, File Deletion, Indicator Removal
Linux System Reboot Via System Request Key
System Shutdown/Reboot
Windows Security Account Manager Stopped
Service Stop
Ryuk Test Files Detected
Data Encrypted for Impact
Windows System Shutdown CommandLine
System Shutdown/Reboot
Windows Service Stop Win Updates
Service Stop
Linux High Frequency Of File Deletion In Boot Folder
Data Destruction, File Deletion, Indicator Removal
Windows Common Abused Cmd Shell Risk Behavior
File and Directory Permissions Modification, System Network Connections Discovery, System Owner/User Discovery, System Shutdown/Reboot, System Network Config...
AWS Detect Users with KMS keys performing encryption S3
Data Encrypted for Impact
Linux Deletion of SSL Certificate
Data Destruction, File Deletion, Indicator Removal
Linux Deletion Of Init Daemon Script
Data Destruction, File Deletion, Indicator Removal
Windows High File Deletion Frequency
Data Destruction
Linux Deletion Of Services
Data Destruction, File Deletion, Indicator Removal
Windows Processes Killed By Industroyer2 Malware
Service Stop
Windows Service Stop Via Net and SC Application
Service Stop
Prevent Automatic Repair Mode using Bcdedit
Inhibit System Recovery
Linux Deleting Critical Directory Using RM Command
Data Destruction
Windows Service Stop By Deletion
Service Stop
Large Volume of DNS ANY Queries
Network Denial of Service, Reflection Amplification
Large Volume of DNS ANY Queries
Network Denial of Service, Reflection Amplification
Windows Service Deletion In Registry
Service Stop
Linux Stop Services
Service Stop
Samsam Test File Write
Data Encrypted for Impact
Splunk Improperly Formatted Parameter Crashes splunkd
Endpoint Denial of Service
WBAdmin Delete System Backups
Inhibit System Recovery
Resize ShadowStorage volume
Inhibit System Recovery
Detect IPv6 Network Infrastructure Threats
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Excessive File Deletion In WinDefender Folder
Data Destruction
Windows Disable Memory Crash Dump
Data Destruction
Windows Raw Access To Master Boot Record Drive
Disk Structure Wipe, Disk Wipe
Windows Raw Access To Master Boot Record Drive
Disk Structure Wipe, Disk Wipe
Linux High Frequency Of File Deletion In Etc Folder
Data Destruction, File Deletion, Indicator Removal
Splunk DOS Via Dump SPL Command
Application or System Exploitation
Deleting Shadow Copies
Inhibit System Recovery
Delete A Net User
Account Access Removal
BCDEdit Failure Recovery Modification
Inhibit System Recovery
WBAdmin Delete System Backups
Inhibit System Recovery
Resize Shadowstorage Volume
Service Stop
Disable Net User Account
Service Stop, Valid Accounts
Attempt To Disable Services
Service Stop
Attempt To Delete Services
Service Stop, Create or Modify System Process, Windows Service
Sdelete Application Execution
Data Destruction, File Deletion, Indicator Removal