Detection rules › Sigma

Directory Removal Via Rmdir

Severity
low
Author
frack113
Source
upstream

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1070.004 Indicator Removal: File Deletion

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\cmd.exe'
OriginalFileName: Cmd.Exe

Stage 2: all of selection_rmdir

CommandLine|contains: rmdir

Stage 3: all of selection_flags

or:
CommandLine|contains: '/q'
CommandLine|contains: '/s'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /q corpus 2 (sigma 2)
  • /s corpus 3 (sigma 3)
  • rmdir
Imageends_with
  • \cmd.exe corpus 92 (sigma 92)
OriginalFileNameeq
  • Cmd.Exe corpus 32 (sigma 30, splunk 2)