File Deletion

Status: stable
Severity: informational
Log source: category process_creation, product linux
Author: Ömer Günal, oscd.community
Source: github.com/SigmaHQ/sigma

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070.004` Indicator Removal: File Deletion

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: File Deletion
id: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
status: stable
description: Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
author: Ömer Günal, oscd.community
date: 2020-10-07
modified: 2022-09-15
tags:
    - attack.stealth
    - attack.t1070.004
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '/rm'     # covers /rmdir as well
            - '/shred'
            - '/unlink'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: informational

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - '/rm'
        - '/shred'
        - '/unlink'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/rm` `/shred` `/unlink`	`field:"Image" kind:ends_with`