Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.
| Data Component | Name | Channel |
|---|---|---|
| File Deletion (DC0040) | WinEventLog:Sysmon | EventCode=23 |
| File Access (DC0055) | WinEventLog:Security | EventCode=4663 |
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4104 |
| Field | Description |
|---|---|
| TimeWindow | Defines correlation window after suspicious binary execution or login session. |
| FilePathPattern | Focuses on deletion of temp files, malware staging dirs, or known indicators. |
| UserContext | Privilege level or impersonated user deleting sensitive files. |
Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via rm, unlink, or secure deletion tools like shred, especially when performed by unexpected users or shortly after execution.
| Data Component | Name | Channel |
|---|---|---|
| File Deletion (DC0040) | auditd:SYSCALL | PATH |
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Field | Description |
|---|---|
| PathRegex | Pattern matching known attacker staging directories or hidden file paths. |
| TimeWindow | Deletion shortly after process execution or privilege escalation. |
| SecureDeletionTool | Uncommon presence or use of `shred`, `wipe`, or `srm`. |
Detects removal of adversary artifacts via rm, unlink, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | fs:fsusage | unlink, write |
| Process Creation (DC0032) | macos:unifiedlog | process |
| Field | Description |
|---|---|
| FilePathRegex | Focus on LaunchAgents, /tmp/, or user folders. |
| ToolUsageAnomaly | Detecting use of unfamiliar tools by common users. |
Detects manual or scripted removal of logs, artifacts, or malware droppings via rm or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.
| Data Component | Name | Channel |
|---|---|---|
| File Deletion (DC0040) | esxi:shell | /var/log/shell.log |
| Field | Description |
|---|---|
| LogFilePath | Match deletion actions in system-critical locations or malware drop zones. |
| TimeWindow | Typically follows suspicious admin login or unexpected shell session. |