AN0411
Analytic 0411
Windows
Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=23
[TargetFilename]
Filter file deletion activity to sensitive locations (e.g., %System32%, Documents, DB paths).
[ProcessCommandLine]
Tune for aggressive overwrite flags (e.g., /w, /q, /s) or temp file overwrites.
[VolumeThreshold]
Threshold of unique file deletions or modifications within time window.
[TimeWindow]
Correlate rapid file delete/overwrite behavior from same process/user.
AN0412
Analytic 0412
Linux
Massive recursive deletions or overwrites via `rm -rf`, `shred`, `dd`, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.
auditd:SYSCALL
unlink, unlinkat, openat, write
auditd:SYSCALL
execve
[ExecutablePath]
Focus on binaries like shred, dd, wipe, custom wipers, or bash execution chains.
[DeletedPathPattern]
Tune for critical mount points or home/data directories.
[SyscallBurstRate]
Rate of unlink/unlinkat syscalls to indicate mass deletion in a short period.
AN0413
Analytic 0413
macOS
Destruction via `rm -rf`, overwrite with `dd` or `srm`, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.
macos:unifiedlog
exec rm -rf|dd if=/dev|srm|file unlink
macos:unifiedlog
process.*exit.*code
[CommandPattern]
Focus on high-risk patterns in temporary directories or key system paths.
[EntropyChangeRate]
Optional anomaly detection on overwritten files with high-entropy payloads.
AN0414
Analytic 0414
IaaS
Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with `Delete*` or `TerminateInstances`.
AWS:CloudTrail
DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances
[OperationType]
Correlate multiple destructive API calls over short intervals.
[UserAgent]
Flag non-console/API clients initiating destructive behavior.
[RegionScope]
Observe whether deletions span multiple regions or org accounts.
AN0415
Analytic 0415
ESXi
Adversary destroys virtual disks (VMDK), images, or VMs by invoking `vim-cmd`, deleting datastore contents, or purging snapshots.
esxi:vmkernel
file delete|datastore purge
[DatastorePath]
Targeted deletion of critical VMDKs or VM configuration files.
[InitiatingUser]
Detect deletions from users outside normal maintenance windows.
AN0416
Analytic 0416
Containers
Container process executes destructive file operations inside volume mounts or host paths. Includes `rm -rf /mnt/volumes/`, container breakout followed by host deletion attempts.
auditd:SYSCALL
unlink, unlinkat, rmdir
docker:events
container exec rm|container stop --force
[MountPoint]
Identify when deletions occur inside persistent or shared volume paths.
[ContainerImage]
Correlate destructive behavior with unknown or untrusted container sources.