{"id":"T1070.004","name":"File Deletion","url":"https://attack.mitre.org/techniques/T1070/004","tactics":["stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0140","stix_id":"x-mitre-detection-strategy--b96fce76-6b29-4e1c-b8b1-741f45a89fdc","name":"Behavioral Detection of Malicious File Deletion","url":"https://attack.mitre.org/detectionstrategies/DET0140","analytics":[{"id":"AN0392","stix_id":"x-mitre-analytic--b1ee9791-91f8-4788-9e08-c40eedbcf08b","name":"Analytic 0392","description":"Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.","url":"https://attack.mitre.org/detectionstrategies/DET0140#AN0392","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=23","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines correlation window after suspicious binary execution or login session."},{"field":"FilePathPattern","description":"Focuses on deletion of temp files, malware staging dirs, or known indicators."},{"field":"UserContext","description":"Privilege level or impersonated user deleting sensitive files."}],"live":true,"detection_strategies":["DET0140"],"techniques":["T1070.004"]},{"id":"AN0393","stix_id":"x-mitre-analytic--874f0437-1aab-4cfe-a30a-7586c0602b6f","name":"Analytic 0393","description":"Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via `rm`, `unlink`, or secure deletion tools like `shred`, especially when performed by unexpected users or shortly after execution.","url":"https://attack.mitre.org/detectionstrategies/DET0140#AN0393","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"PATH","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"PathRegex","description":"Pattern matching known attacker staging directories or hidden file paths."},{"field":"TimeWindow","description":"Deletion shortly after process execution or privilege escalation."},{"field":"SecureDeletionTool","description":"Uncommon presence or use of `shred`, `wipe`, or `srm`."}],"live":true,"detection_strategies":["DET0140"],"techniques":["T1070.004"]},{"id":"AN0394","stix_id":"x-mitre-analytic--175bf607-fca6-4555-a30b-3d6cd4cfe876","name":"Analytic 0394","description":"Detects removal of adversary artifacts via `rm`, `unlink`, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.","url":"https://attack.mitre.org/detectionstrategies/DET0140#AN0394","platforms":["macOS"],"log_source_references":[{"name":"fs:fsusage","channel":"unlink, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fsusage"},{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"FilePathRegex","description":"Focus on LaunchAgents, /tmp/, or user folders."},{"field":"ToolUsageAnomaly","description":"Detecting use of unfamiliar tools by common users."}],"live":true,"detection_strategies":["DET0140"],"techniques":["T1070.004"]},{"id":"AN0395","stix_id":"x-mitre-analytic--3f53ca22-5efe-43b3-8225-5fdd4b8a8194","name":"Analytic 0395","description":"Detects manual or scripted removal of logs, artifacts, or malware droppings via `rm` or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.","url":"https://attack.mitre.org/detectionstrategies/DET0140#AN0395","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"/var/log/shell.log","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"LogFilePath","description":"Match deletion actions in system-critical locations or malware drop zones."},{"field":"TimeWindow","description":"Typically follows suspicious admin login or unexpected shell session."}],"live":true,"detection_strategies":["DET0140"],"techniques":["T1070.004"]}],"live":true,"version":"1.0","techniques":["T1070.004"]}],"sigma_rules":[{"id":"0a1f9d29-6465-4776-b091-7f43b26e4c89","title":"Prefetch File Deleted","author":"Cedric MAURUGEON","status":"test","level":"high","date":"2021-09-29","modified":"2024-01-25","description":"Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence","references":["Internal Research","https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/file/file_delete/file_delete_win_delete_prefetch.yml","techniques":["T1070.004"],"cves":[]},{"id":"204b17ae-4007-471b-917b-b917b315c5db","title":"Greedy File Deletion Using Del","author":"frack113 , X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2021-12-02","modified":"2023-09-11","description":"Detects execution of the \"del\" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.","references":["https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml","techniques":["T1070.004"],"cves":[]},{"id":"30aed7b6-d2c1-4eaf-9382-b6bc43e50c57","title":"File Deletion","author":"Ömer Günal, oscd.community","status":"stable","level":"informational","date":"2020-10-07","modified":"2022-09-15","description":"Detects file deletion using \"rm\", \"shred\" or \"unlink\" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/linux/process_creation/proc_creation_lnx_file_deletion.yml","techniques":["T1070.004"],"cves":[]},{"id":"3109530e-ab47-4cc6-a953-cac5ebcc93ae","title":"ADS Zone.Identifier Deleted By Uncommon Application","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-04","modified":"2025-07-04","description":"Detects the deletion of the \"Zone.Identifier\" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.","references":["https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/","Internal Research"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml","techniques":["T1070.004"],"cves":[]},{"id":"379fa130-190e-4c3f-b7bc-6c8e834485f3","title":"File Deletion Via Del","author":"frack113","status":"test","level":"low","date":"2022-01-15","modified":"2024-03-05","description":"Detects execution of the builtin \"del\"/\"erase\" commands in order to delete files.\nAdversaries may delete files left behind by the actions of their intrusion activity.\nMalware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.\nRemoval of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml","techniques":["T1070.004"],"cves":[]},{"id":"39a80702-d7ca-4a83-b776-525b1f86a36d","title":"Potential Secure Deletion with SDelete","author":"Thomas Patzke","status":"test","level":"medium","date":"2017-06-14","modified":"2024-12-13","description":"Detects files that have extensions commonly seen while SDelete is used to wipe files.","references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm","https://www.jpcert.or.jp/english/pub/sr/ir_research.html","https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete"],"logsource":{"product":"windows","service":"security"},"tags":["attack.impact","attack.stealth","attack.defense-impairment","attack.t1070.004","attack.t1027.005","attack.t1485","attack.t1553.002","attack.s0195"],"path":"rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml","techniques":["T1070.004","T1027.005","T1485","T1553.002"],"cves":[]},{"id":"41ca393d-538c-408a-ac27-cf1e038be80c","title":"Directory Removal Via Rmdir","author":"frack113","status":"test","level":"low","date":"2022-01-15","modified":"2023-03-07","description":"Detects execution of the builtin \"rmdir\" command in order to delete directories.\nAdversaries may delete files left behind by the actions of their intrusion activity.\nMalware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.\nRemoval of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml","techniques":["T1070.004"],"cves":[]},{"id":"54786ddc-5b8a-11ed-9b6a-0242ac120002","title":"Suspicious Ping/Del Command Combination","author":"Ilya Krestinichev","status":"test","level":"high","date":"2022-11-03","modified":"2024-03-05","description":"Detects a method often used by ransomware. Which combines the \"ping\" to wait a couple of seconds and then \"del\" to delete the file in question. Its used to hide the file responsible for the initial infection for example","references":["https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack","https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf","https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml","techniques":["T1070.004"],"cves":[]},{"id":"6ddab845-b1b8-49c2-bbf7-1a11967f64bc","title":"File Deleted Via Sysinternals SDelete","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2023-02-15","description":"Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/9","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml","techniques":["T1070.004"],"cves":[]},{"id":"71d65515-c436-43c0-841b-236b1f32c21e","title":"Cisco File Deletion","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-12","modified":"2023-01-04","description":"See what files are being deleted from flash file systems","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.impact","attack.stealth","attack.t1070.004","attack.t1561.001","attack.t1561.002"],"path":"rules/network/cisco/aaa/cisco_cli_file_deletion.yml","techniques":["T1070.004","T1561.001","T1561.002"],"cves":[]},{"id":"7eac0a16-5832-4e81-865f-0268a6d19e4b","title":"ADS Zone.Identifier Deleted","author":"frack113","status":"test","level":"low","date":"2023-09-04","modified":null,"description":"Detects the deletion of the \"Zone.Identifier\" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.","references":["https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.stealth","attack.t1070.004","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_delete/file_delete_win_zone_identifier_ads.yml","techniques":["T1070.004"],"cves":[]},{"id":"9703792d-fd9a-456d-a672-ff92efe4806a","title":"Backup Catalog Deleted","author":"Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)","status":"test","level":"medium","date":"2017-05-12","modified":"2022-12-25","description":"Detects backup catalog deletions","references":["https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx","https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100"],"logsource":{"product":"windows","service":"application"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml","techniques":["T1070.004"],"cves":[]},{"id":"b1decb61-ed83-4339-8e95-53ea51901720","title":"TeamViewer Log File Deleted","author":"frack113","status":"test","level":"low","date":"2022-01-16","modified":"2023-02-15","description":"Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml","techniques":["T1070.004"],"cves":[]},{"id":"b8af5f36-1361-4ebe-9e76-e36128d947bf","title":"Use Of Remove-Item to Delete File - ScriptBlock","author":"frack113","status":"test","level":"low","date":"2022-01-15","modified":"2022-03-17","description":"PowerShell Remove-Item  with -Path to delete a file or a folder with \"-Recurse\"","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md","https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Remove-Item?view=powershell-5.1&viewFallbackFrom=powershell-7"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070.004","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_remove_item_path.yml","techniques":["T1070.004"],"cves":[]},{"id":"ded2b07a-d12f-4284-9b76-653e37b6c8b0","title":"Potentially Suspicious Ping/Copy Command Combination","author":"X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2023-07-18","modified":"2024-03-06","description":"Detects uncommon and potentially suspicious one-liner command containing both \"ping\" and \"copy\" at the same time, which is usually used by malware.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1070.004"],"path":"rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml","techniques":["T1070.004"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-32756","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-22952","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}