Windows del/erase Command-Line File Deletion via cmd.exe

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.004File Deletion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where cmd.exe executes built-in del or erase commands to delete files. File deletion can help attackers remove artifacts created during intrusion activity or post-intrusion cleanup to reduce observable traces. The detection relies on Windows process creation telemetry, matching cmd.exe execution along with del/erase command-line substrings and optional flags such as -f, -s, and -q.

Reporting behind it

Related detections9 linkedT1070.004 — drag to rearrange

Suspicious Crontab Removal via Command Line (via process_creation)

Suspicious Self-Deletion via Ping Loopback and Del (via process_creation)

Malicious Self-Deletion Via Fsutil SetZeroData

Self-Deletion via Ping Loopback Delay and Del Command

Suspicious Deletion of Explorer RunMRU Values

Suspicious PowerShell Self-Delete Of Executable via Process Creation

Suspicious Prefetch Deletion for Anti-Forensics

Malicious Ransomware Self-Deletion via Ping Loopback and Del

Suspicious Self-Deletion Batch Artifact by JadeProx TriBack Loader (via file_event)

Windows del/erase Command-Line File Deletion via cmd.exe

Pivot detection · T1070.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-deletion-using-cmd-exe-del-erase-commands-379fa130

title: Windows del/erase Command-Line File Deletion via cmd.exe
id: e43827b7-1d34-4e1a-8153-574bcf3d2599
status: test
description: This rule flags process creation events where cmd.exe executes built-in del or erase commands to delete files. File deletion can help attackers remove artifacts created during intrusion activity or post-intrusion cleanup to reduce observable traces. The detection relies on Windows process creation telemetry, matching cmd.exe execution along with del/erase command-line substrings and optional flags such as -f, -s, and -q.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_del:
    CommandLine|contains:
      - "del "
      - "erase "
  selection_flags:
    CommandLine|contains|windash:
      - " -f"
      - " -s"
      - " -q"
  condition: all of selection_*
falsepositives:
  - False positives levels will differ Depending on the environment. You can use a combination of ParentImage and other keywords from the CommandLine field to filter legitimate activity
level: low
license: DRL-1.1
related:
  - id: 379fa130-190e-4c3f-b7bc-6c8e834485f3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL