Windows File Deletion Using cmd.exe del/erase Commands

Flags cmd.exe executions running del/erase for file removal, including common flags like /f, /s, and /q.

FreeUnreviewedSigmalowv1

windows-file-deletion-using-cmd-exe-del-erase-commands-379fa130

title: Windows File Deletion Using cmd.exe del/erase Commands
id: e43827b7-1d34-4e1a-8153-574bcf3d2599
status: test
description: This rule identifies Windows process executions of cmd.exe where the command line contains file deletion keywords del or erase. Attackers may remove files created during intrusion activity to reduce evidence and minimize their footprint. It relies on Windows process creation telemetry with command-line content to confirm the use of these built-in deletion commands and common flags such as forced deletion, recursive deletion, and quiet mode.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_del:
    CommandLine|contains:
      - "del "
      - "erase "
  selection_flags:
    CommandLine|contains|windash:
      - " -f"
      - " -s"
      - " -q"
  condition: all of selection_*
falsepositives:
  - False positives levels will differ Depending on the environment. You can use a combination of ParentImage and other keywords from the CommandLine field to filter legitimate activity
level: low
license: DRL-1.1
related:
  - id: 379fa130-190e-4c3f-b7bc-6c8e834485f3
    type: derived

What it detects

This rule identifies Windows process executions of cmd.exe where the command line contains file deletion keywords del or erase. Attackers may remove files created during intrusion activity to reduce evidence and minimize their footprint. It relies on Windows process creation telemetry with command-line content to confirm the use of these built-in deletion commands and common flags such as forced deletion, recursive deletion, and quiet mode.

Known false positives

False positives levels will differ Depending on the environment. You can use a combination of ParentImage and other keywords from the CommandLine field to filter legitimate activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.