Linux High Frequency Of File Deletion In Etc Folder

name: Linux High Frequency Of File Deletion In Etc Folder
id: 9d867448-2aff-4d07-876c-89409a752ff8
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. It leverages the Endpoint.Filesystem data model to identify instances where 200 or more files are deleted within an hour, grouped by process name and process ID. This behavior is significant as it may indicate the presence of wiper malware, such as AcidRain, which aims to delete critical system files. If confirmed malicious, this activity could lead to severe system instability, data loss, and potential disruption of services.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` values(Filesystem.file_access_time) as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) as file_name values(Filesystem.file_path) as file_path  values(Filesystem.file_acl) as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) as process_id values(Filesystem.user) as user dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path = "/etc/*"
      BY _time span=1h Filesystem.dest
         Filesystem.process_guid Filesystem.action Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | where  numOfDelFilePath >= 200
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Multiple files delted in /etc/ folder on $dest$ by process GUID -  $process_guid$
analytic_story:
    - AcidRain
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint