huntrule

Windows rmdir Command Execution for Directory Removal

Monitors cmd.exe process creation where rmdir is used with /s and/or /q to delete directories and reduce forensic artifacts.

FreeUnreviewedSigmalowv1
title: Windows rmdir Command Execution for Directory Removal
id: 35616cae-7a92-402f-9014-ca7aafa9a6d1
status: test
description: This rule flags process creation events where cmd.exe runs a built-in rmdir command to remove directories. Attackers commonly use directory deletion to remove artifacts left by intrusion activity and reduce observable traces. The detection relies on Windows process creation telemetry, matching cmd.exe execution with command-line content that includes rmdir and optional /s and /q flags.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2023-03-07
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_rmdir:
    CommandLine|contains: rmdir
  selection_flags:
    CommandLine|contains:
      - /s
      - /q
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/info.yml
license: DRL-1.1
related:
  - id: 41ca393d-538c-408a-ac27-cf1e038be80c
    type: derived

What it detects

This rule flags process creation events where cmd.exe runs a built-in rmdir command to remove directories. Attackers commonly use directory deletion to remove artifacts left by intrusion activity and reduce observable traces. The detection relies on Windows process creation telemetry, matching cmd.exe execution with command-line content that includes rmdir and optional /s and /q flags.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.