Windows PowerShell ScriptBlock Remove-Item Used to Delete Files or Folders

title: Windows PowerShell ScriptBlock Remove-Item Used to Delete Files or Folders
id: 3982e1de-62a5-4ba1-a023-4e701de03476
status: test
description: This rule flags PowerShell ScriptBlock logging events that contain commands commonly used to remove files or directories, such as Remove-Item -Path and short aliases (del/erase/rm/ri/rd/rmdir) paired with -Path. File and folder deletion is a common tactic for attackers to cover tracks or remove targeted artifacts. Telemetry relies on PowerShell ScriptBlockText content captured by Script Block Logging and matches specific string patterns indicating destructive removal commands.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Remove-Item?view=powershell-5.1&viewFallbackFrom=powershell-7
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_remove_item_path.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2022-03-17
tags:
  - attack.stealth
  - attack.t1070.004
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - "Remove-Item -Path "
      - "del -Path "
      - "erase -Path "
      - "rd -Path "
      - "ri -Path "
      - "rm -Path "
      - "rmdir -Path "
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: b8af5f36-1361-4ebe-9e76-e36128d947bf
    type: derived