T1070.004 File Deletion — Detection Rules

Source-backed rule directory

• File Deletion · stable · informational · {"product":"linux","category":"process_creation"}
• Cisco File Deletion · test · medium · {"product":"cisco","service":"aaa"}
• Backup Catalog Deleted · test · medium · {"product":"windows","service":"application"}
• Potential Secure Deletion with SDelete · test · medium · {"product":"windows","service":"security"}
• Prefetch File Deleted · test · high · {"product":"windows","category":"file_delete"}
• TeamViewer Log File Deleted · test · low · {"product":"windows","category":"file_delete"}
• File Deleted Via Sysinternals SDelete · test · medium · {"product":"windows","category":"file_delete"}
• ADS Zone.Identifier Deleted By Uncommon Application · test · medium · {"product":"windows","category":"file_delete"}
• File Deletion Via Del · test · low · {"category":"process_creation","product":"windows"}
• Greedy File Deletion Using Del · test · medium · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Ping/Copy Command Combination · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Ping/Del Command Combination · test · high · {"category":"process_creation","product":"windows"}
• Directory Removal Via Rmdir · test · low · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1070.004 File Deletion

MATCH(deletion_of_executable_script_or_log_file) AND actor_or_path NOT_IN approved_deletion_activity -> ALERT

• File-System Activity Logs
• File-Integrity Monitoring Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0140 Behavioral Detection of Malicious File Deletion

AN0392 Analytic 0392

Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.

AN0393 Analytic 0393

Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via `rm`, `unlink`, or secure deletion tools like `shred`, especially when performed by unexpected users or shortly after execution.

AN0394 Analytic 0394

Detects removal of adversary artifacts via `rm`, `unlink`, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.

AN0395 Analytic 0395

Detects manual or scripted removal of logs, artifacts, or malware droppings via `rm` or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.