CmdID

CmdID / Commands

rm

Remove each argument from the filesystem. toybox

On Linux, Windows 5 Sigma rules name it

Linux

from the toybox, 0BSD

rm [-fiRrv] FILE...

-fForce: remove without confirmation, no error if it doesn't exist

-iInteractive: prompt for confirmation

-rRRecursive: remove directory contents

-vVerbose

Several platforms

from tldr-pages, CC BY 4.0

Remove files or directories.

Remove specific files

rm path/to/file1 path/to/file2 ...Identify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

Remove specific files ignoring nonexistent ones

rm --force path/to/file1 path/to/file2 ...Identify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

Remove specific files interactively prompting before each removal

rm --interactive path/to/file1 path/to/file2 ...Identify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

Remove specific files printing info about each removal

rm --verbose path/to/file1 path/to/file2 ...Identify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

Remove specific files and directories recursively

rm --recursive path/to/file_or_directory1 path/to/file_or_directory2 ...Identify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

Remove empty directories (this is considered the safe method)

rm --dir path/to/directoryIdentify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

Windows

from tldr-pages, CC BY 4.0

In PowerShell, this command is an alias of Remove-Item.

What detects it

Sigma process creation rules that name rm

highHistory File DeletionFlorian Roth (Nextron Systems)

highSyslog Clearing or Removal Via System UtilitiesMax Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC

mediumIndicator Removal on Host - Clear Mac System Logsremotephone, oscd.community

mediumLinux Logs Clearing AttemptsÖmer Günal, oscd.community

informationalFile DeletionÖmer Günal, oscd.community