Techniques › T1070 › T1070.004
T1070.004 File Deletion
stealth — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
15
Sigma rules tagged attack.t1070.004
5
KEV CVEs mapped here
<p>Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.</p><p>There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include <code>del</code> on Windows, <code>rm</code> or <code>unlink</code> on Linux and macOS, and
rm on ESXi.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-32756 | Fortinet Multiple Products | secondary impact | Mapped | 2025-05-14 |
| CVE-2023-22952 | SugarCRM Multiple Products | secondary impact | Stale | 2023-02-02 |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | secondary impact | Mapped | 2021-12-01 |
| CVE-2020-5902 | F5 BIG-IP | secondary impact | Stale | 2021-11-03 |
| CVE-2021-40539 | Zoho ManageEngine | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0140 Behavioral Detection of Malicious File Deletion v1.0
AN0392 WindowsDetects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.Tunable:
TimeWindowFilePathPatternUserContextAN0393 LinuxDetects deletion of suspicious files (e.g., payloads, temp exes, scripts) viarm,unlink, or secure deletion tools likeshred, especially when performed by unexpected users or shortly after execution.Tunable:PathRegexTimeWindowSecureDeletionToolAN0394 macOSDetects removal of adversary artifacts viarm,unlink, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.Tunable:FilePathRegexToolUsageAnomalyAN0395 ESXiDetects manual or scripted removal of logs, artifacts, or malware droppings viarmor PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.Tunable:LogFilePathTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1070.004
Author: Cedric MAURUGEON
· 2021-09-29 (modified 2024-01-25) · logsource: product=windows category=file_delete · 0a1f9d29-6465-4776-b091-7f43b26e4c89
Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
Author: frack113 , X__Junior (Nextron Systems)
· 2021-12-02 (modified 2023-09-11) · logsource: product=windows category=process_creation · 204b17ae-4007-471b-917b-b917b315c5db
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.
Author: Ömer Günal, oscd.community
· 2020-10-07 (modified 2022-09-15) · logsource: product=linux category=process_creation · 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-04 (modified 2025-07-04) · logsource: product=windows category=file_delete · 3109530e-ab47-4cc6-a953-cac5ebcc93ae
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
Author: frack113
· 2022-01-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 379fa130-190e-4c3f-b7bc-6c8e834485f3
Detects execution of the builtin "del"/"erase" commands in order to delete files.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Author: Thomas Patzke
· 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Author: frack113
· 2022-01-15 (modified 2023-03-07) · logsource: product=windows category=process_creation · 41ca393d-538c-408a-ac27-cf1e038be80c
Detects execution of the builtin "rmdir" command in order to delete directories.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Author: Ilya Krestinichev
· 2022-11-03 (modified 2024-03-05) · logsource: product=windows category=process_creation · 54786ddc-5b8a-11ed-9b6a-0242ac120002
Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-05-02 (modified 2023-02-15) · logsource: product=windows category=file_delete · 6ddab845-b1b8-49c2-bbf7-1a11967f64bc
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 71d65515-c436-43c0-841b-236b1f32c21e
See what files are being deleted from flash file systems
Author: frack113
· 2023-09-04 · logsource: product=windows category=file_delete · 7eac0a16-5832-4e81-865f-0268a6d19e4b
Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)
· 2017-05-12 (modified 2022-12-25) · logsource: product=windows service=application · 9703792d-fd9a-456d-a672-ff92efe4806a
Detects backup catalog deletions
Author: frack113
· 2022-01-16 (modified 2023-02-15) · logsource: product=windows category=file_delete · b1decb61-ed83-4339-8e95-53ea51901720
Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence
Author: frack113
· 2022-01-15 (modified 2022-03-17) · logsource: product=windows category=ps_script · b8af5f36-1361-4ebe-9e76-e36128d947bf
PowerShell Remove-Item with -Path to delete a file or a folder with "-Recurse"
Author: X__Junior (Nextron Systems)
· 2023-07-18 (modified 2024-03-06) · logsource: product=windows category=process_creation · ded2b07a-d12f-4284-9b76-653e37b6c8b0
Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.
Rules tagged at the parent level (attack.t1070) 20
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-02 · logsource: product=windows category=process_creation · 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Author: Christian Burkard (Nextron Systems)
· 2021-10-19 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
Detects the deletion of registry keys containing the MSTSC connection history
Author: Christian Burkard (Nextron Systems)
· 2021-08-27 (modified 2023-01-23) · logsource: product=windows service=msexchange-management · 09570ae5-889e-43ea-aac0-0e1221fb3d95
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2022-11-25) · logsource: product=windows category=ps_script · 115fdba9-f017-42e6-84cf-d5573bf2ddf8
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Author: Janantha Marasinghe
· 2022-12-13 (modified 2022-12-28) · logsource: product=aws service=cloudtrail · 20f754db-d025-4a8f-9d74-e0037e999a9a
Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-16 · logsource: product=windows category=file_delete · 270185ff-5f50-4d6d-a27f-24c3b8c9fef8
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · 3132570d-cab2-4561-9ea6-1743644b2290
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-09-16 (modified 2023-02-15) · logsource: product=windows category=file_delete · 3eb8c339-a765-48cc-a150-4364c04652bf
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-13 (modified 2025-10-07) · logsource: product=windows category=process_creation · 4931188c-178e-4ee7-a348-39e8a7a56821
Detect filter driver unloading activity via fltmc.exe
Author: Kirill Kiryanov, oscd.community
· 2019-10-23 (modified 2023-02-13) · logsource: product=windows category=process_creation · 4d7cda18-1b12-4e52-b45c-d28653210df8
Detects possible Sysmon filter driver unloaded via fltmc.exe
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 · logsource: product=windows category=file_delete · 63c779ba-f638-40a0-a593-ddd45e8b1ddc
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)
· 2023-03-09 · logsource: product=linux category=process_creation · 95d61234-7f56-465c-6f2d-b562c6fedbc4
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-17 (modified 2023-09-18) · logsource: product=windows category=image_load · 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Author: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
· 2019-03-22 (modified 2022-06-28) · logsource: product=windows category=process_creation · a238b5d0-ce2d-4414-a676-7a531b3d13d6
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-26 (modified 2022-12-30) · logsource: product=windows category=file_delete · a55349d8-9588-4c5a-8e3b-1925fe2a4ffe
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
Author: Ecco, E.M. Anhaus, oscd.community
· 2019-09-26 (modified 2023-09-09) · logsource: product=windows category=process_creation · add64136-62e5-48ea-807e-88638d02df1e
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-25) · logsource: product=windows category=ps_script · bde47d4b-9987-405c-94c7-b080410e8ea7
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)
· 2019-10-22 (modified 2022-11-03) · logsource: product=windows category=process_creation · c947b146-0abc-4c87-9c64-b17e9d7274a2
Shadow Copies deletion using operating systems utilities
Author: @neu5ron
· 2019-02-07 (modified 2023-02-15) · logsource: product=windows category=process_creation · c9fbe8e9-119d-40a6-9b59-dd58a5d84429
Detects potential malicious and unauthorized usage of bcdedit.exe
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 · logsource: product=windows category=file_delete · ff301988-c231-4bd0-834c-ac9d73b86586
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence