Detection rules › Sigma

Greedy File Deletion Using Del

Severity
medium
Author
frack113 , X__Junior (Nextron Systems)
Source
upstream

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1070.004 Indicator Removal: File Deletion

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\cmd.exe'
OriginalFileName: Cmd.Exe

Stage 2: all of selection_del

or:
CommandLine|contains: 'del '
CommandLine|contains: 'erase '

Stage 3: all of selection_extensions

or:
CommandLine|contains: '\\\*.au3'
CommandLine|contains: '\\\*.dll'
CommandLine|contains: '\\\*.exe'
CommandLine|contains: '\\\*.js'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • \\\*.au3
  • \\\*.dll
  • \\\*.exe
  • \\\*.js
  • del corpus 5 (sigma 5)
  • erase corpus 3 (sigma 3)
Imageends_with
  • \cmd.exe corpus 92 (sigma 92)
OriginalFileNameeq
  • Cmd.Exe corpus 32 (sigma 30, splunk 2)