Michael Haag
66c37e8b53
+ Added wevtutil and fsutil per what was used recently by BadBuddy Ransomware. + Added 2 ways to compress data with Powershell and rar.
12 lines
245 B
Markdown
12 lines
245 B
Markdown
# File Deletion
|
|
|
|
MITRE ATT&CK Technique: [T1002](https://attack.mitre.org/wiki/Technique/T1002)
|
|
|
|
## PowerShell
|
|
|
|
powershell.exe dir c:\* -Recurse | Compress-Archive -DestinationPath C:\test\Data.zip
|
|
|
|
## Rar
|
|
|
|
rar a -r exfilthis.rar *.docx
|