Cross-source coverage
T1070.004 / ATT&CK
Indicator Removal: File Deletion
80 rules · 76 families across 7 sources.
4 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and rm on ESXi.
- Tactics
- Stealth
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:PowerShellauditd:SYSCALLfs:fsusagemacos:unifiedlogesxi:shell
How MITRE says to detect it DET0140
Behavioral Detection of Malicious File Deletion
Windows Analytic 0392
Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.
WinEventLog:SysmonEventCode=23WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 0393
Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via `rm`, `unlink`, or secure deletion tools like `shred`, especially when performed by unexpected users or shortly after execution.
auditd:SYSCALLPATHauditd:SYSCALLexecve
macOS Analytic 0394
Detects removal of adversary artifacts via `rm`, `unlink`, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.
fs:fsusageunlink, writemacos:unifiedlogprocess
ESXi Analytic 0395
Detects manual or scripted removal of logs, artifacts, or malware droppings via `rm` or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.
esxi:shell/var/log/shell.log
Wazuh Core Ruleset
20 rules| Detection | Severity | Format |
|---|---|---|
| Netscaler: UI/API dangerous command | High | Wazuh XML |
| An item has been deleted from quarantine | Medium | Wazuh XML |
| Docker: Container deleted · docker.status = delete | Medium | Wazuh XML |
| Docker: Volume destroyed in · docker.Action = destroy | Medium | Wazuh XML |
| File deleted. | Medium | Wazuh XML |
| File deletion by . Command · win.eventdata.originalFileName = (?i)sdelete\.exe | Medium | Wazuh XML |
| IPsec dropped an inbound clear text packet that should have been secured | Medium | Wazuh XML |
| IPsec dropped an inbound packet that failed a replay check | Medium | Wazuh XML |
| Windows audit log was cleared | Medium | Wazuh XML |
| Audit: Deleted: . · match type=DELETE | Low | Wazuh XML |
+ 10 more from Wazuh Core Ruleset → showing the 10 highest-severity
SigmaHQ/sigma
15 rules| Detection | Severity | Format |
|---|---|---|
| Prefetch File Deleted | High | Sigma |
| Suspicious Ping/Del Command Combination | High | Sigma |
| ADS Zone.Identifier Deleted By Uncommon Application | Medium | Sigma |
| Backup Catalog Deleted | Medium | Sigma |
| Cisco File Deletion | Medium | Sigma |
| File Deleted Via Sysinternals SDelete | Medium | Sigma |
| Greedy File Deletion Using Del | Medium | Sigma |
| Potentially Suspicious Ping/Copy Command Combination | Medium | Sigma |
| Potential Secure Deletion with SDelete | Medium | Sigma |
| ADS Zone.Identifier Deleted | Low | Sigma |
+ 5 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
15 rules| Detection | Severity | Format |
|---|---|---|
| Clear Unallocated Sector Using Cipher App | Undefined | SPL |
| Linux Account Manipulation Of SSH Config and Keys | Undefined | SPL |
| Linux Deletion Of Cron Jobs | Undefined | SPL |
| Linux Deletion Of Init Daemon Script | Undefined | SPL |
| Linux Deletion Of Services | Undefined | SPL |
| Linux Deletion of SSL Certificate | Undefined | SPL |
| Linux High Frequency Of File Deletion In Boot Folder | Undefined | SPL |
| Linux High Frequency Of File Deletion In Etc Folder | Undefined | SPL |
| Linux Indicator Removal Service File Deletion | Undefined | SPL |
| Recursive Delete of Directory In Batch CMD | Undefined | SPL |
+ 5 more from splunk/security_content → showing the 10 highest-severity
elastic/detection-rules
13 rules| Detection | Severity | Format |
|---|---|---|
| File Creation, Execution and Self-Deletion in Suspicious Directory | High | Elastic TOML |
| Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers | High | Elastic TOML |
| Potential REMCOS Trojan Execution | High | Elastic TOML |
| File Deletion via Shred | Medium | Elastic TOML |
| Process Execution Followed by Self-Deletion | Medium | Elastic TOML |
| Suspicious Print Spooler File Deletion | Medium | Elastic TOML |
| System Log File Deletion | Medium | Elastic TOML |
| WebServer Access Logs Deleted | Medium | Elastic TOML |
| Delete Volume USN Journal with Fsutil | Low | Elastic TOML |
| Kubernetes Events Deleted | Low | Elastic TOML |
+ 3 more from elastic/detection-rules → showing the 10 highest-severity
elastic/protections-artifacts
12 rules · 11 families| Detection | Severity | Format |
|---|---|---|
| Multiple System Log Files Deletion | Undefined | Elastic TOML |
| Node Script Execution and Immediate Deletion 2 variants | Undefined | Elastic TOML |
| Node Script Execution and Immediate Deletion 2 variants | Undefined | Elastic TOML |
| Potential Self Deletion of a Running Executable | Undefined | Elastic TOML |
| Process Execution Followed by Self-Deletion | Undefined | Elastic TOML |
| Python Library Load and Delete | Undefined | Elastic TOML |
| Self-Deleted Python Script Outbound Network Connection | Undefined | Elastic TOML |
| Self-Deleting Python Script | Undefined | Elastic TOML |
| SSH Authorized Keys File Deletion | Undefined | Elastic TOML |
| Suspicious PowerShell Console History Deletion | Undefined | Elastic TOML |
+ 2 more from elastic/protections-artifacts → showing the 10 highest-severity
chainguard-dev/osquery-defense-kit
4 rules · 3 families| Detection | Severity | Format |
|---|---|---|
| A program where the parent PID is not on disk 2 variants | Undefined | osquery SQL |
| A program where the parent PID is not on disk 2 variants | Undefined | osquery SQL |
| Processes that do not exist on disk | Undefined | osquery SQL |
| Processes that do not exist on disk, running in osquery's namespace | Undefined | osquery SQL |
socfortress/Wazuh-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential indicator removal: deletion or shredding of critical files in sensitive Linux paths (/etc, /var/log, /usr/bin, /boot) | High | Wazuh XML |