Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.[1] Examples of built-in Command and Scripting Interpreter functions include del
on Windows and rm
or unlink
on Linux and macOS.
ID | Name | Description |
---|---|---|
C0028 | 2015 Ukraine Electric Power Attack |
During the 2015 Ukraine Electric Power Attack, vba_macro.exe deletes itself after |
S0045 | ADVSTORESHELL |
ADVSTORESHELL can delete files and directories.[3] |
S0504 | Anchor |
Anchor can self delete its dropper after the malware is successfully deployed.[4] |
S0584 | AppleJeus | |
S0622 | AppleSeed |
AppleSeed can delete files from a compromised host after they are exfiltrated.[6] |
G0026 | APT18 |
APT18 actors deleted tools and batch files from victim systems.[7] |
G0007 | APT28 |
APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.[8] |
G0016 | APT29 |
APT29 has used SDelete to remove artifacts from victim networks.[9] |
G0022 | APT3 | |
G0050 | APT32 | |
G0082 | APT38 |
APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.[12][13] |
G0087 | APT39 |
APT39 has used malware to delete files after they are deployed on a compromised host.[14] |
G0096 | APT41 | |
G1023 | APT5 |
APT5 has deleted scripts and web shells to evade detection.[17][18] |
G0143 | Aquatic Panda |
Aquatic Panda has deleted malicious executables from compromised machines.[19] |
S0456 | Aria-body |
Aria-body has the ability to delete files and directories on compromised hosts.[20] |
S0438 | Attor |
Attor’s plugin deletes the collected files and log files after exfiltration.[21] |
S0347 | AuditCred | |
S0344 | Azorult | |
S0414 | BabyShark |
BabyShark has cleaned up all files associated with the secondary payload execution.[24] |
S0475 | BackConfig |
BackConfig has the ability to remove files and folders related to previous infections.[25] |
S0093 | Backdoor.Oldrea |
Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.[26] |
S1081 | BADHATCH |
BADHATCH has the ability to delete PowerShell scripts from a compromised machine.[27] |
S0234 | Bandook | |
S0239 | Bankshot |
Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.[29] |
S0534 | Bazar |
Bazar can delete its loader using a batch file in the Windows temporary folder.[30] |
S0127 | BBSRAT | |
S0268 | Bisonal |
Bisonal will delete its dropper and VBS scripts from the victim’s machine.[32][33][34] |
S0069 | BLACKCOFFEE |
BLACKCOFFEE has the capability to delete files.[35] |
S0520 | BLINDINGCAN |
BLINDINGCAN has deleted itself and associated artifacts from victim machines.[36] |
S0657 | BLUELIGHT | |
G0060 | BRONZE BUTLER |
The BRONZE BUTLER uploader or malware the uploader uses |
S1039 | Bumblebee |
Bumblebee can uninstall its loader through the use of a |
C0032 | C0032 |
During the C0032 campaign, TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.[40] |
S0274 | Calisto |
Calisto has the capability to use |
S0030 | Carbanak | |
S0348 | Cardinal RAT |
Cardinal RAT can uninstall itself, including deleting its executable.[43] |
S0462 | CARROTBAT |
CARROTBAT has the ability to delete downloaded files from a compromised host.[44] |
S1043 | ccf32 |
ccf32 can delete files and folders from compromised machines.[45] |
S0674 | CharmPower |
CharmPower can delete created files from a compromised system.[46] |
S0107 | Cherry Picker |
Recent versions of Cherry Picker delete files and registry keys created by the malware.[47] |
G0114 | Chimera | |
S0106 | cmd | |
S1105 | COATHANGER |
COATHANGER removes files from victim environments following use in multiple instances.[50] |
G0080 | Cobalt Group |
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.[51] |
S0115 | Crimson |
Crimson has the ability to delete files from a compromised host.[52][53][54] |
S0498 | Cryptoistic |
Cryptoistic has the ability delete files from a compromised host.[55] |
S0527 | CSPY Downloader |
CSPY Downloader has the ability to self delete.[56] |
S0625 | Cuba |
Cuba can use the command |
C0029 | Cutting Edge |
During Cutting Edge, threat actors deleted |
S1014 | DanBot |
DanBot can delete its configuration file after installation.[60] |
S0673 | DarkWatchman |
DarkWatchman has been observed deleting its original launcher after installation.[61] |
S0354 | Denis |
Denis has a command to delete files from the victim’s machine.[62][63] |
S0021 | Derusbi |
Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.[64][65] |
G0035 | Dragonfly |
Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.[66] |
S0502 | Drovorub |
Drovorub can delete specific files from a compromised host.[67] |
S0567 | Dtrack | |
S0062 | DustySky |
DustySky can delete files it creates from the infected system.[69] |
S0593 | ECCENTRICBANDWAGON |
ECCENTRICBANDWAGON can delete log files generated from the malware stored at |
S0081 | Elise |
Elise is capable of launching a remote shell on the host to delete itself.[71] |
S0091 | Epic | |
S0396 | EvilBunny |
EvilBunny has deleted the initial dropper after running through the environment checks.[73] |
G0120 | Evilnum | |
S0401 | Exaramel for Linux |
Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.[75] |
S0181 | FALLCHILL |
FALLCHILL can delete malware and associated artifacts from the victim.[76] |
S0512 | FatDuke | |
S0267 | FELIXROOT |
FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.[78] |
S0679 | Ferocious | |
G0051 | FIN10 |
FIN10 has used batch scripts and scheduled tasks to delete critical system files.[80] |
G0053 | FIN5 |
FIN5 uses SDelete to clean up the environment and attempt to prevent detection.[81] |
G0037 | FIN6 | |
G0061 | FIN8 |
FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.[83][84] |
S0381 | FlawedAmmyy |
FlawedAmmyy can execute batch scripts to delete files.[85] |
S0277 | FruitFly | |
S1044 | FunnyDream |
FunnyDream can delete files including its dropper component.[45] |
S0410 | Fysbis | |
G0047 | Gamaredon Group |
Gamaredon Group tools can delete files used during an operation.[88][89][90] |
S0168 | Gazer |
Gazer has commands to delete files and persistence mechanisms from the victim.[91][92] |
S0666 | Gelsemium |
Gelsemium can delete its dropper component from the targeted system.[93] |
S0032 | gh0st RAT | |
S0249 | Gold Dragon |
Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.[96] |
S0493 | GoldenSpy |
GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.[97] |
S0531 | Grandoreiro |
Grandoreiro can delete .LNK files created in the Startup folder.[98] |
S0690 | Green Lambert |
Green Lambert can delete the original executable after initial installation in addition to unused functions.[99][100] |
S0342 | GreyEnergy |
GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.[101] |
S0632 | GrimAgent |
GrimAgent can delete old binaries on a compromised host.[102] |
G0043 | Group5 |
Malware used by Group5 is capable of remotely deleting files from victims.[103] |
S0561 | GuLoader |
GuLoader can delete its executable from the |
S0151 | HALFBAKED | |
S0499 | Hancitor |
Hancitor has deleted files using the VBA |
S0391 | HAWKBALL | |
S0697 | HermeticWiper |
HermeticWiper has the ability to overwrite its own file with random bites.[108][109] |
S1027 | Heyoka Backdoor |
Heyoka Backdoor has the ability to delete folders and files from a targeted system.[110] |
S0087 | Hi-Zor |
Hi-Zor deletes its RAT installer file as it executes its DLL payload file.[111] |
S0601 | Hildegard | |
S0431 | HotCroissant |
HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.[113] |
S0070 | HTTPBrowser |
HTTPBrowser deletes its original installer file once installation is complete.[114] |
S0203 | Hydraq |
Hydraq creates a backdoor through which remote attackers can delete files.[115][116] |
S0398 | HyperBro | |
S1022 | IceApple |
IceApple can delete files and directories from targeted systems.[118] |
S0434 | Imminent Monitor |
Imminent Monitor has deleted files related to its dynamic debugger feature.[119] |
S0259 | InnaputRAT |
InnaputRAT has a command to delete files.[120] |
S0260 | InvisiMole |
InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.[121][122] |
S0015 | Ixeshe |
Ixeshe has a command to delete a file from the machine.[123] |
S0044 | JHUHUGIT |
The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.[124][125] |
S0201 | JPIN |
JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.[126] |
S0283 | jRAT |
jRAT has a function to delete files from the victim’s machine.[127] |
S0265 | Kazuar | |
S1020 | Kevin |
Kevin can delete files created on the victim's machine.[129] |
S0271 | KEYMARBLE |
KEYMARBLE has the capability to delete files off the victim’s machine.[130] |
S0607 | KillDisk | |
G0094 | Kimsuky |
Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.[132][133][134] |
S0437 | Kivars |
Kivars has the ability to uninstall malware from the infected host.[135] |
S0162 | Komplex | |
S0356 | KONNI | |
G0032 | Lazarus Group |
Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.[138][139] |
S0395 | LightNeuron |
LightNeuron has a function to delete files.[140] |
S0211 | Linfo |
Linfo creates a backdoor through which remote attackers can delete files.[141] |
S0513 | LiteDuke |
LiteDuke can securely delete files by first writing random data to the file.[77] |
S0372 | LockerGoga |
LockerGoga has been observed deleting its original launcher after execution.[142] |
S0447 | Lokibot |
Lokibot will delete its dropped files after bypassing UAC.[143] |
S0582 | LookBack |
LookBack removes itself after execution and can delete files on the system.[144] |
S0451 | LoudMiner | |
S0409 | Machete |
Once a file is uploaded, Machete will delete it from the machine.[146] |
S1016 | MacMa | |
S0282 | MacSpy | |
G0059 | Magic Hound |
Magic Hound has deleted and overwrote files to cover tracks.[149][150][151] |
G0045 | menuPass |
A menuPass macro deletes files after it has decoded and decompressed them.[152][153] |
S0443 | MESSAGETAP |
Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk. [154] |
G1013 | Metador |
Metador has quickly deleted |
S1059 | metaMain |
metaMain has deleted collected items after uploading the content to its C2 server.[155][156] |
S0455 | Metamorfo |
Metamorfo has deleted itself from the system after execution.[157][158] |
S0688 | Meteor |
Meteor will delete the folder containing malicious scripts if it detects the hostname as |
S1015 | Milan |
Milan can delete files via |
S0083 | Misdat | |
S0149 | MoonWind | |
S0284 | More_eggs | |
S1047 | Mori |
Mori can delete its DLL file and related files by Registry value.[163] |
S0256 | Mosquito | |
S0233 | MURKYTOP | |
G0129 | Mustang Panda |
Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.[165] |
S0228 | NanHaiShu |
NanHaiShu launches a script to delete their original decoy file to cover tracks.[166] |
S0630 | Nebulae |
Nebulae has the ability to delete files and directories.[167] |
S0385 | njRAT | |
S0353 | NOKKI | |
S0346 | OceanSalt | |
G0049 | OilRig |
OilRig has deleted files associated with their payload after execution.[172][173] |
S0439 | Okrum |
Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.[174] |
S0264 | OopsIE |
OopsIE has the capability to delete files and scripts from the victim's machine.[175] |
C0022 | Operation Dream Job |
During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.[176] |
C0006 | Operation Honeybee |
During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.[177] |
C0014 | Operation Wocao |
During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using |
S0352 | OSX_OCEANLOTUS.D |
OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.[179][180][181] |
S1017 | OutSteel |
OutSteel can delete itself following the successful execution of a follow-on payload.[182] |
S0598 | P.A.S. Webshell |
P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.[75] |
S0208 | Pasam |
Pasam creates a backdoor through which remote attackers can delete files.[183] |
G0040 | Patchwork |
Patchwork removed certain files and replaced them so they could not be retrieved.[184] |
S0556 | Pay2Key | |
S1050 | PcShare |
PcShare has deleted its files and components from a compromised host.[45] |
S0587 | Penquin |
Penquin can delete downloaded executables after running them.[186] |
S0517 | Pillowmint |
Pillowmint has deleted the filepath |
S0435 | PLEAD |
PLEAD has the ability to delete files on the compromised host.[135] |
S0067 | pngdowner |
pngdowner deletes content from C2 communications that was saved to the user's temporary directory.[188] |
S0428 | PoetRAT |
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.[189] |
S0453 | Pony |
Pony has used scripts to delete itself after execution.[190] |
S0139 | PowerDuke |
PowerDuke has a command to write random data across a file and delete it.[191] |
S0441 | PowerShower |
PowerShower has the ability to remove all files created during the dropper process.[192] |
S0223 | POWERSTATS |
POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.[193] |
S0113 | Prikormka |
After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[194] |
S0654 | ProLock |
ProLock can remove files containing its payload after they are executed.[195] |
S0279 | Proton | |
S0238 | Proxysvc |
Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.[139] |
S0147 | Pteranodon |
Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.[196] |
S0196 | PUNCHBUGGY |
PUNCHBUGGY can delete files written to disk.[83][197] |
S1032 | PyDCrypt |
PyDCrypt will remove all created artifacts such as dropped executables.[198] |
S0583 | Pysa | |
S0650 | QakBot |
QakBot can delete folders and files including overwriting its executable with legitimate programs.[200][201][202][195] |
S0269 | QUADAGENT |
QUADAGENT has a command to delete its Registry key and scheduled task.[203] |
S0629 | RainyDay |
RainyDay has the ability to uninstall itself by deleting its service and files.[167] |
S0662 | RCSession | |
S0495 | RDAT |
RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.[205] |
S0416 | RDFSNIFFER |
RDFSNIFFER has the capability of deleting local files.[206] |
S0172 | Reaver |
Reaver deletes the original dropped file from the victim.[207] |
S0153 | RedLeaves | |
S0125 | Remsec |
Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.[209][210][211] |
S0496 | REvil |
REvil can mark its binary code for deletion after reboot.[212] |
S0448 | Rising Sun |
Rising Sun can delete files and artifacts it creates.[213] |
G0106 | Rocke | |
S0240 | ROKRAT | |
S0148 | RTM |
RTM can delete all files created during its execution.[216][217] |
S0253 | RunningRAT |
RunningRAT contains code to delete files from the victim’s machine.[96] |
S0085 | S-Type |
S-Type has deleted files it has created on a compromised host.[160] |
S1018 | Saint Bot |
Saint Bot can run a batch script named |
S0074 | Sakula |
Some Sakula samples use cmd.exe to delete temporary files.[218] |
S0370 | SamSam |
SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.[219] |
G0034 | Sandworm Team |
Sandworm Team has used backdoors that can delete files used in an attack from an infected system.[131][220] |
S0461 | SDBbot |
SDBbot has the ability to delete files from a compromised host.[221] |
S0195 | SDelete |
SDelete deletes data in a way that makes it unrecoverable.[1] |
S0053 | SeaDuke |
SeaDuke can securely delete files, including deleting itself from the victim.[222] |
S0345 | Seasalt | |
S0382 | ServHelper |
ServHelper has a module to delete itself from the infected machine.[224][225] |
S1019 | Shark |
Shark can delete files downloaded to the compromised host.[60] |
S0444 | ShimRat |
ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.[226] |
S0589 | Sibot |
Sibot will delete itself if a certain server response is received.[227] |
G0091 | Silence |
Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.[228][229] |
S0692 | SILENTTRINITY |
SILENTTRINITY can remove files from the compromised host.[230] |
S0533 | SLOTHFULMEDIA |
SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.[231] |
C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.[232] |
S0615 | SombRAT |
SombRAT has the ability to run |
S0374 | SpeakUp |
SpeakUp deletes files to remove evidence on the machine. [234] |
S0390 | SQLRat |
SQLRat has used been observed deleting scripts once used.[235] |
S0380 | StoneDrill |
StoneDrill has been observed deleting the temporary files once they fulfill their task.[236] |
S1034 | StrifeWater |
StrifeWater can self delete to cover its tracks.[237] |
S0491 | StrongPity |
StrongPity can delete previously exfiltrated files from the compromised host.[238][239] |
S0603 | Stuxnet |
Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.[240] |
S0559 | SUNBURST | |
S0562 | SUNSPOT |
Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named |
S0663 | SysUpdate |
SysUpdate can delete its configuration file from the targeted system.[243] |
S0011 | Taidoor |
Taidoor can use |
S0586 | TAINTEDSCRIBE |
TAINTEDSCRIBE can delete files from a compromised host.[245] |
S0164 | TDTESS |
TDTESS creates then deletes log files during installation of itself as a service.[246] |
G0139 | TeamTNT |
TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.[247][248] |
G0089 | The White Company |
The White Company has the ability to delete its malware entirely from the target system.[249] |
G0027 | Threat Group-3390 |
Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.[250][251] |
S0094 | Trojan.Karagany |
Trojan.Karagany has used plugins with a self-delete capability.[252] |
G0081 | Tropic Trooper |
Tropic Trooper has deleted dropper files on an infected system using command scripts.[253] |
S0263 | TYPEFRAME | |
S0022 | Uroburos |
Uroburos can run a |
S0386 | Ursnif |
Ursnif has deleted data staged in tmp files after exfiltration.[256] |
S0136 | USBStealer |
USBStealer has several commands to delete files associated with the malware from the victim.[257] |
S0442 | VBShower |
VBShower has attempted to complicate forensic analysis by deleting all the files contained in |
S0257 | VERMIN | |
S0180 | Volgmer |
Volgmer can delete files and itself after infection to avoid analysis.[260] |
G1017 | Volt Typhoon |
Volt Typhoon has run |
S0689 | WhisperGate |
WhisperGate can delete tools from a compromised host after execution.[262] |
S0155 | WINDSHIELD |
WINDSHIELD is capable of file deletion along with other file system interaction.[263] |
S0466 | WindTail |
WindTail has the ability to receive and execute a self-delete command.[264] |
S0176 | Wingbird |
Wingbird deletes its payload along with the payload's parent process after it finishes copying files.[265] |
S0141 | Winnti for Windows |
Winnti for Windows can delete the DLLs for its various components from a compromised host.[266] |
G0102 | Wizard Spider |
Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.[267] |
S1065 | Woody RAT |
Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using |
S0161 | XAgentOSX |
XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.[269] |
S0251 | Zebrocy |
Zebrocy has a command to delete files and directories.[270][271][272] |
S0330 | Zeus Panda |
Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.[273] |
S0350 | zwShell |
zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.[274] |
S0412 | ZxShell |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0017 | Command | Command Execution |
Monitor executed commands and arguments for actions that could be utilized to unlink, rename, or delete files. |
DS0022 | File | File Deletion |
Monitor for unexpected deletion of files from the system |