AN0392
Analytic 0392
Windows
Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.
WinEventLog:Sysmon
EventCode=23
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[TimeWindow]
Defines correlation window after suspicious binary execution or login session.
[FilePathPattern]
Focuses on deletion of temp files, malware staging dirs, or known indicators.
[UserContext]
Privilege level or impersonated user deleting sensitive files.
AN0393
Analytic 0393
Linux
Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via `rm`, `unlink`, or secure deletion tools like `shred`, especially when performed by unexpected users or shortly after execution.
auditd:SYSCALL
PATH
auditd:SYSCALL
execve
[PathRegex]
Pattern matching known attacker staging directories or hidden file paths.
[TimeWindow]
Deletion shortly after process execution or privilege escalation.
[SecureDeletionTool]
Uncommon presence or use of `shred`, `wipe`, or `srm`.
AN0394
Analytic 0394
macOS
Detects removal of adversary artifacts via `rm`, `unlink`, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.
fs:fsusage
unlink, write
macos:unifiedlog
process
[FilePathRegex]
Focus on LaunchAgents, /tmp/, or user folders.
[ToolUsageAnomaly]
Detecting use of unfamiliar tools by common users.
AN0395
Analytic 0395
ESXi
Detects manual or scripted removal of logs, artifacts, or malware droppings via `rm` or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.
esxi:shell
/var/log/shell.log
[LogFilePath]
Match deletion actions in system-critical locations or malware drop zones.
[TimeWindow]
Typically follows suspicious admin login or unexpected shell session.