attack.t1070.004

ADS Zone.Identifier Deleted By Uncommon Application

Sep 6, 2023 · attack.defense_evasion attack.t1070.004 ·

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Suspicious Ping/Copy Command Combination

Jul 24, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects uncommon one-liner command having ping and copy at the same time, which is usually used by malware.

Suspicious Ping/Del Command Combination

Jul 20, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Backup Catalog Deleted

Apr 14, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects backup catalog deletions

Directory Removal Via Rmdir

Mar 7, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

File Deletion Via Del

Mar 7, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Greedy File Deletion Using Del

Mar 7, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

File Deleted Via Sysinternals SDelete

Feb 17, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Prefetch File Deleted

Feb 17, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

TeamViewer Log File Deleted

Feb 17, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

Use Remove-Item to Delete File

Jan 27, 2023 · attack.defense_evasion attack.t1070.004 ·

Share on:

Powershell Remove-Item with -Path to delete a file or a folder with "-Recurse"

Cisco File Deletion

Jan 4, 2023 · attack.defense_evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·

Share on:

See what files are being deleted from flash file systems

Secure Deletion with SDelete

Oct 25, 2022 · attack.impact attack.defense_evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·

Share on:

Detects renaming of file while deletion with SDelete tool.

File Deletion

Oct 25, 2022 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity