Sigma rule: File Deletion Via Del

Rule

Title

File Deletion Via Del

Status

test

Level

low

Author

frack113

Date

2022-01-15

Modified

2024-03-05

File

rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the builtin "del"/"erase" commands in order to delete files.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'
selection_del:
    CommandLine|contains:
        - 'del '
        - 'erase '
selection_flags:
    CommandLine|contains|windash:
        - ' -f' # Force deleting of read-only files.
        - ' -s' # Delete specified files from all subdirectories.
        - ' -q' # Quiet mode, do not ask if ok to delete on global wildcard
condition: all of selection_*

False positives (as the rule lists them)

• False positives levels will differ Depending on the environment. You can use a combination of ParentImage and other keywords from the CommandLine field to filter legitimate activity

Tags

• attack.stealth
• attack.t1070.004

MITRE ATT&CK ids this rule names

• T1070.004

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml