T1107 - File Deletion

Description from ATT&CK

Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native cmd functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)

Detection: It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.

Platforms: Linux, Windows, macOS

Data Sources: Binary file metadata, File monitoring, Process command-line parameters

Defense Bypassed: Host forensic analysis

Permissions Required: User

Contributors: Walker Johnson

Atomic Tests

Atomic Test #1 - Victim configuration
Atomic Test #2 - Delete a single file
Atomic Test #3 - Delete an entire folder
Atomic Test #4 - Overwrite and delete a file with shred
Atomic Test #5 - Victim configuration
Atomic Test #6 - Delete a single file - cmd
Atomic Test #7 - Delete an entire folder - cmd
Atomic Test #8 - Delete a single file - ps
Atomic Test #9 - Delete an entire folder - ps
Atomic Test #10 - Delete VSS - vssadmin
Atomic Test #11 - Delete VSS - wmic
Atomic Test #12 - bcdedit
Atomic Test #13 - wbadmin

Atomic Test #1 - Victim configuration

Create a temporary directory and several files on the victim system for later deletion

Supported Platforms: Linux

Run it with `sh`!

mkdir /tmp/victim-files
cd /tmp/victim-files
touch a b c d e f g
echo "This file will be shredded" > /tmp/victim-shred.txt

Atomic Test #2 - Delete a single file

Delete a single file from the temporary directory

Supported Platforms: Linux

Run it with `sh`!

rm -f /tmp/victim-files/a

Atomic Test #3 - Delete an entire folder

Recursively delete the temporary directory and all files contained within it

Supported Platforms: Linux

Run it with `sh`!

rm -rf /tmp/victim-files

Atomic Test #4 - Overwrite and delete a file with shred

Use the shred command to overwrite the temporary file and then delete it

Supported Platforms: Linux