Linux File Deletion via rm, shred, or unlink Process Creation

Alerts on Linux process executions of rm, shred, or unlink used to delete files.

FreeUnreviewedSigmainformationalv1

linux-file-deletion-via-rm-shred-or-unlink-process-creation-30aed7b6

title: Linux File Deletion via rm, shred, or unlink Process Creation
id: 9d3d2194-b597-4298-a94a-5fa736ed7799
status: stable
description: This rule identifies Linux process executions where the program path ends with /rm, /shred, or /unlink, indicating command-line attempts to delete files. File deletion is a common attacker technique to remove artifacts from prior activity, so these command executions can be valuable for stealth and defense investigations. It relies on process creation telemetry capturing the executing program path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_file_deletion.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2022-09-15
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /rm
      - /shred
      - /unlink
  condition: selection
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
    type: derived

What it detects

This rule identifies Linux process executions where the program path ends with /rm, /shred, or /unlink, indicating command-line attempts to delete files. File deletion is a common attacker technique to remove artifacts from prior activity, so these command executions can be valuable for stealth and defense investigations. It relies on process creation telemetry capturing the executing program path.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.