T1070.004 Indicator Removal: File Deletion

Adversaries may delete files left behind by the actions of their intrusion activity. MITRE ATT&CK

Part of

MITRE ATT&CK

T1070Indicator Removal

process creation, the highest levels first

mediumGreedy File Deletion Using Delfrack113 , X__Junior (Nextron Systems) · Windows

lowFile Deletion Via Delfrack113 · Windows

informationalFile DeletionÖmer Günal, oscd.community · Linux

everyday examples from tldr-pages, CC BY 4.0

Overwrite a file on the page for shred

shred path/to/fileIdentify

Overwrite a file and show progress on the screen on the page for shred

shred --verbose path/to/fileIdentify

Overwrite a file, leaving zeros instead of random data on the page for shred

shred --zero path/to/fileIdentify

Test your microphone by recording a 5 second sample and playing it back on the page for arecord

arecord --duration 5 test-mic.wav && aplay test-mic.wav && rm test-mic.wavIdentify

Force the deletion of read-only files on the page for del

del file_pattern /fIdentify

Recursively delete file(s) from all subdirectories on the page for del

del file_pattern /sIdentify

Do not prompt when deleting files based on a global wildcard on the page for del

del file_pattern /qIdentify

[Interactive] Remove a torrent from the daemon on the page for deluge-console

rm torrent_idIdentify

Reset apps usage count (default cache directory: $XDG_CACHE_HOME/fuzzel) on the page for fuzzel

rm --verbose $HOME/.cache/fuzzelIdentify

Mark bank.csv as all new, as if not yet imported on the page for hledger-import

rm --force .latest.bank.csvIdentify

[Interactive] Remove a partition in interactive mode on the page for parted.interactive

rm /dev/sdXNIdentify

Remove specific files on the page for rm

rm path/to/file1 path/to/file2 ...Identify

And 10 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1070.004: a Sigma rule it trips is tagged with it, or its abuse is documented as it.