Windows Prefetch .pf File Deletion via FileDelete

Flags deletion of .pf files in \\Windows\\Prefetch, a possible attempt to remove execution artifacts.

FreeUnreviewedSigmahighv1

windows-prefetch-pf-file-deletion-via-filedelete-0a1f9d29

title: Windows Prefetch .pf File Deletion via FileDelete
id: 37933900-5ab2-4c93-8cb2-7673b0bf3729
status: test
description: This rule identifies deletions of Windows Prefetch files (.pf) under the \\Windows\\Prefetch directory. Deleting prefetch artifacts can hinder forensic recovery of recently executed applications, which attackers may do to reduce evidence trails. It relies on Windows file deletion telemetry containing the target filename, along with process image and user context to exclude a specific svchost-related false-positive pattern.
references:
  - Internal Research
  - https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_prefetch.yml
author: Cedric MAURUGEON, Huntrule Team
date: 2021-09-29
modified: 2024-01-25
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    TargetFilename|contains: :\Windows\Prefetch\
    TargetFilename|endswith: .pf
  filter_main_svchost:
    Image|endswith: :\windows\system32\svchost.exe
    User|contains:
      - AUTHORI
      - AUTORI
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0a1f9d29-6465-4776-b091-7f43b26e4c89
    type: derived

What it detects

This rule identifies deletions of Windows Prefetch files (.pf) under the \\Windows\\Prefetch directory. Deleting prefetch artifacts can hinder forensic recovery of recently executed applications, which attackers may do to reduce evidence trails. It relies on Windows file deletion telemetry containing the target filename, along with process image and user context to exclude a specific svchost-related false-positive pattern.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.