Browse Rules

Snowflake - Possible data destraction

'Detects possible data destruction.'

Databricks Destructive Activities

Detects high volume destructive activities by a single user which may indicate malicious data destruction, ransomware, or insider threats.

Azure Storage Account Deleted

Detects when an Azure storage account is deleted. Storage account deletion is a destructive operation that may indicate ransomware activity or malicious data destruction.

MSSQL Destructive Query

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

MSSQL Destructive Query

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

Azure Storage Account Blob Versioning Disabled

Detects when Azure storage account blob versioning is disabled. Disabling versioning removes protection against accidental deletion or modification and may indicate preparation for permanent data destruction.

Azure Key Vault Deleted

Detects when an Azure Key Vault is deleted. Key Vault deletion is a destructive operation that may indicate ransomware activity or malicious destruction of secrets and encryption keys.

Azure Storage Blob Soft Delete Disabled

Detects when Azure storage account blob soft delete is disabled. Disabling soft delete removes protection against accidental deletion and may indicate preparation for data destruction.

Azure Storage Container Soft Delete Disabled

Detects when Azure storage account container soft delete is disabled. Disabling container soft delete removes protection against accidental deletion and may indicate preparation for data destruction.

S3 Bucket Deleted

A S3 Bucket, Policy, or Website was deleted

S3 Bucket Versioning Suspended

Detects when S3 bucket versioning is suspended or disabled, which removes the ability to recover previous versions of objects and is a common precursor to ransomware attacks or data destruction.

Tape Erase Job Started

Detects when tape erase operations start. This might indicate data destruction activity.

Azure Key Vault Permanently Purged

Detects when an entire Azure Key Vault is permanently purged. Purging a Key Vault is an irreversible operation that permanently destroys all keys, secrets, and certificates stored within it. This is more destructive than deleting a vault and may indicate ransomware activity or malicious data destruction.

Notion Many Pages Deleted [Deprecated]

(Deprecated due to false-positive rate) A Notion User deleted multiple pages.

Azure Resource Group Deleted

Detects when an Azure Resource Group is deleted. Resource group deletion removes all resources within the group and may indicate mass destruction or legitimate cleanup.

Azure SQL Server Deleted

Detects when an Azure SQL Server is deleted. SQL Server deletion is a destructive operation that removes the entire database server instance and all databases within it.

AWS S3 Bucket Versioning

Checks that object versioning is enabled in the S3 bucket.

Notion Many Pages Deleted

A Notion User deleted multiple pages, which were not created or restored from the trash within the same hour.

S3 Bucket Replication Deleted

Detects when S3 bucket replication configuration is deleted, which could prevent data backup and indicate ransomware preparation activity.

Azure VM Snapshot Deleted

Detects when an Azure disk snapshot is deleted. Snapshots serve critical functions for backup, disaster recovery, and forensic analysis. Adversaries may target snapshots to prevent data recovery, destroy forensic evidence, or undermine backup strategies before launching ransomware or destructive operations.

S3 Bucket Encryption Deleted

Detects when S3 bucket encryption configuration is deleted, which could expose data to unauthorized access or indicate ransomware preparation activity.

GCP Audit Logs - Detect Bulk VM Snapshot Deletion

'Detects bulk deletion of Google Cloud VM snapshots within a short time period, which may indicate data destruction or defense evasion activities. VM snapshots are critical for backup and disaster recovery. Bulk deletion of snapshots can prevent recovery from incidents and may indicate malicious activity such as ransomware, data destruction, or an attempt to cover tracks after a security breach. Adversaries may delete snapshots to maximize damage, prevent forensic investigation, or hinder recove

Google Workspace Multiple Files Deleted From Google Drive

Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.

Netskope Many Objects Deleted

A user deleted a large number of objects in a short period of time.

Delete Important Scheduled Task

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities