File Deletion

A Sigma rule for process creation on Linux, by Ömer Günal, oscd.community.

informational 1 ATT&CK technique 3 programs it names 15 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    Image|endswith:
      - '/rm'
      - '/shred'
      - '/unlink'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Ömer Günal, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Overwrite a file on the page for shred

shred path/to/fileIdentify

Overwrite a file and show progress on the screen on the page for shred

shred --verbose path/to/fileIdentify

Overwrite a file, leaving zeros instead of random data on the page for shred

shred --zero path/to/fileIdentify

Test your microphone by recording a 5 second sample and playing it back on the page for arecord

arecord --duration 5 test-mic.wav && aplay test-mic.wav && rm test-mic.wavIdentify

[Interactive] Remove a torrent from the daemon on the page for deluge-console

rm torrent_idIdentify

Reset apps usage count (default cache directory: $XDG_CACHE_HOME/fuzzel) on the page for fuzzel

rm --verbose $HOME/.cache/fuzzelIdentify

Mark bank.csv as all new, as if not yet imported on the page for hledger-import

rm --force .latest.bank.csvIdentify

[Interactive] Remove a partition in interactive mode on the page for parted.interactive

rm /dev/sdXNIdentify

Remove specific files on the page for rm

rm path/to/file1 path/to/file2 ...Identify

Remove specific files ignoring nonexistent ones on the page for rm

rm --force path/to/file1 path/to/file2 ...Identify

Remove specific files interactively prompting before each removal on the page for rm

rm --interactive path/to/file1 path/to/file2 ...Identify

Remove specific files printing info about each removal on the page for rm

rm --verbose path/to/file1 path/to/file2 ...Identify

And 3 more examples on CmdID’s program pages.

The commands LOLBAS or GTFOBins documents for shred trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

shredrmunlink

ATT&CK

the techniques it is tagged with

T1070.004Indicator Removal: File Deletion

File Deletion

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1070.004 Indicator Removal: File Deletion