File Deletion

Refers to events where files are removed from a system or storage device. These events can indicate legitimate housekeeping activities or malicious actions such as attackers attempting to cover their tracks. Monitoring file deletions helps organizations identify unauthorized or suspicious activities.

This data component can be collected through the following measures:

Windows

• Sysmon: Event ID 23: Logs file deletion events, including details such as file paths and responsible processes.
• Windows Event Log: Enable "Object Access" auditing to monitor file deletions.
• PowerShell: Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4663} | Where-Object {$_.Message -like '*DELETE*'}

Linux

• Auditd: Use audit rules to capture file deletion events: auditctl -a always,exit -F arch=b64 -S unlink -S rename -S rmdir -k file_deletion
• Query logs: ausearch -k file_deletion
• Inotify: Use inotifywait to monitor file deletions: inotifywait -m /path/to/watch -e delete

macOS

• Endpoint Security Framework (ESF): Monitor events like ES_EVENT_TYPE_AUTH_UNLINK to capture file deletion activities.
• FSEvents: Track file deletion activities in real-time: fs_usage | grep unlink

SIEM Integration

• Forward file deletion logs to a SIEM for centralized monitoring and correlation with other events.