detection.wiki

Detection rules › Sigma

Directory Removal Via Rmdir

Status
test
Severity
low
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

MITRE ATT&CK coverage

TacticTechniques
StealthT1070.004 Indicator Removal: File Deletion

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Directory Removal Via Rmdir
id: 41ca393d-538c-408a-ac27-cf1e038be80c
status: test
description: |
    Detects execution of the builtin "rmdir" command in order to delete directories.
    Adversaries may delete files left behind by the actions of their intrusion activity.
    Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
    Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
author: frack113
date: 2022-01-15
modified: 2023-03-07
tags:
    - attack.stealth
    - attack.t1070.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_rmdir:
        CommandLine|contains: 'rmdir'
    selection_flags:
        CommandLine|contains:
            - '/s'
            - '/q'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/info.yml

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'

Stage 2: selection_rmdir

selection_rmdir:
    CommandLine|contains: 'rmdir'

Stage 3: selection_flags

selection_flags:
    CommandLine|contains:
        - '/s'
        - '/q'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /q corpus 8 (sigma 7, splunk 1)
  • /s corpus 8 (sigma 6, splunk 2)
  • rmdir corpus 2 (sigma 1, splunk 1)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
OriginalFileNameeq
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)