{"id":"204b17ae-4007-471b-917b-b917b315c5db","title":"Greedy File Deletion Using Del","description":"Detects execution of the \"del\" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.","author":"frack113 , X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2021-12-02","modified":"2023-09-11","tags":["attack.stealth","attack.t1070.004"],"technique_ids":["T1070.004"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase"],"source_path":"rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml","source_sha256":"6097997542fba37deba71e73b4ac289cc7150f50c4831a586627f01814987f8a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Greedy File Deletion Using Del\nid: 204b17ae-4007-471b-917b-b917b315c5db\nstatus: test\ndescription: Detects execution of the \"del\" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.\nreferences:\n    - https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase\nauthor: frack113 , X__Junior (Nextron Systems)\ndate: 2021-12-02\nmodified: 2023-09-11\ntags:\n    - attack.stealth\n    - attack.t1070.004\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Example:\n    #   del C:\\ProgramData\\*.dll & exit\n    selection_img:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.Exe'\n    selection_del:\n        CommandLine|contains:\n            - 'del '\n            - 'erase '\n    selection_extensions:\n        CommandLine|contains:\n            - '\\\\\\*.au3'\n            - '\\\\\\*.dll'\n            - '\\\\\\*.exe'\n            - '\\\\\\*.js'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070.004","id":"T1070.004","name":"File Deletion","page":"techniques/enterprise/T1070.004/"}],"data_path":"data/detection-rules/204b17ae-4007-471b-917b-b917b315c5db.json","kind":"sigma"}