Windows rmdir Directory Removal via cmd.exe Execution

Monitors cmd.exe process creation where rmdir is used with /s and/or /q to delete directories and reduce forensic artifacts.

FreeReviewedSigma · Low · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.004File Deletion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where Windows cmd.exe runs a command line containing rmdir and optional flags for recursive deletion (/s) and quiet mode (/q). Directory removal is a common post-action step that can reduce leftover artifacts from intrusion activity or other automated cleanup. It relies on Windows process creation telemetry, including process image/filename and the command line arguments.

Reporting behind it

Related detections9 linkedT1070.004 — drag to rearrange

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

Suspicious Zone.Identifier Mark-of-the-Web Removal (via process_creation)

Suspicious Self-Deletion of Dropper via Command Line

Suspicious Self-Deletion via Choice Timer and Del Command via Cmd (via process_creation)

Suspicious Jump List AutomaticDestinations Deletion via Cmd (via process_creation)

Suspicious Self-Delete via cmd choice Timeout and Del

Suspicious Ping Loopback Delay Followed by File Deletion for Evasion

Suspicious Alternate Data Stream Self-Deletion via process_creation

Windows rmdir Directory Removal via cmd.exe Execution

Pivot detection · T1070.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rmdir-command-execution-for-directory-removal-41ca393d

title: Windows rmdir Directory Removal via cmd.exe Execution
id: 35616cae-7a92-402f-9014-ca7aafa9a6d1
status: test
description: This rule identifies process creation where Windows cmd.exe runs a command line containing rmdir and optional flags for recursive deletion (/s) and quiet mode (/q). Directory removal is a common post-action step that can reduce leftover artifacts from intrusion activity or other automated cleanup. It relies on Windows process creation telemetry, including process image/filename and the command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml
author: frack113, Huntrule Team
date: 2022-01-15
modified: 2023-03-07
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_rmdir:
    CommandLine|contains: rmdir
  selection_flags:
    CommandLine|contains:
      - /s
      - /q
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/info.yml
license: DRL-1.1
related:
  - id: 41ca393d-538c-408a-ac27-cf1e038be80c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL