rules/linux/process_creation/proc_creation_lnx_file_deletion.yml

title: File Deletion
id: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
status: stable
description: Detects file deletion commands
author: Ömer Günal, oscd.community
date: 2020/10/07
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.004/T1070.004.md
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '/rm'     # covers /rmdir as well
            - '/shred'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: informational
tags:
    - attack.defense_evasion
    - attack.t1070.004
Create lnx_file_deletion.yml 2020-10-07 22:28:37 +03:00			`title: File Deletion`
			`id: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57`
			`status: stable`
			`description: Detects file deletion commands`
			`author: Ömer Günal, oscd.community`
			`date: 2020/10/07`
			`references:`
change reference 2020-10-16 20:42:12 +03:00			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.004/T1070.004.md`
Create lnx_file_deletion.yml 2020-10-07 22:28:37 +03:00			`logsource:`
			`product: linux`
added category 2020-10-16 10:33:50 +03:00			`category: process_creation`
Create lnx_file_deletion.yml 2020-10-07 22:28:37 +03:00			`detection:`
Update lnx_file_deletion.yml 2020-12-01 21:24:57 +03:00			`selection:`
Renamed ProcessName field to Image for the process_creation category. 2021-02-25 01:57:26 +03:00			`Image\|endswith:`
Update lnx_file_deletion.yml 2020-12-02 01:27:35 +01:00			`- '/rm' # covers /rmdir as well`
			`- '/shred'`
Update lnx_file_deletion.yml 2020-12-01 21:24:57 +03:00			`condition: selection`
Create lnx_file_deletion.yml 2020-10-07 22:28:37 +03:00			`falsepositives:`
			`- Legitimate administration activities`
Fixes and improvements 2021-04-03 00:00:43 +02:00			`level: informational`
Create lnx_file_deletion.yml 2020-10-07 22:28:37 +03:00			`tags:`
			`- attack.defense_evasion`
			`- attack.t1070.004`