CmdID

CmdID / Commands

unlink

Delete one file. toybox

On Linux 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
unlink FILE

Several platforms

from tldr-pages, CC BY 4.0

Remove a link to a file from the filesystem. The file contents is lost if the link is the last one to the file.

Remove the specified file if it is the last link

unlink path/to/fileIdentify

Trips 1 Sigma rule: informationalFile Deletion by Ömer Günal, oscd.community

What detects it

Sigma process creation rules that name unlink
highHistory File DeletionFlorian Roth (Nextron Systems)
highSyslog Clearing or Removal Via System UtilitiesMax Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
mediumIndicator Removal on Host - Clear Mac System Logsremotephone, oscd.community
mediumLinux Logs Clearing AttemptsÖmer Günal, oscd.community
informationalFile DeletionÖmer Günal, oscd.community