Possible File Removal (via process_creation)

title: Possible File Removal (via process_creation)
id: 09a5a62e-c868-51dc-b8ee-ffcab7a139b5
status: stable
description: This rule detects file deletion using "rm", "shred" or "unlink" commands which are used frequently by threat actors to delete files left behind by the actions of their intrusion behavior
references:
    - https://attack.mitre.org/techniques/T1070/004/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
author: Huntrule Team
date: 2026-04-16
tags:
    - attack.stealth
    - attack.t1070.004
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '/rm'
            - '/shred'
            - '/unlink'
    condition: selection
falsepositives:
    - Unknown
level: informational