T1070.004 — File Deletion

Tactic: Stealth · Platforms: ESXi, Linux, macOS, Windows

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (4)

T1070.004 Indicator Removal: File Deletion

title: "T1070.004 Indicator Removal: File Deletion"
id: cfe6b3cb-b9f7-4302-becf-a279e49caa78
description: 'Behavioral Detection of Malicious File Deletion. (Data Component: File Deletion; baseline tier: windows-eventid.) Tune using: TimeWindow, FilePathPattern, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1070/004
author: Shahrukh Khan
date: 2026-01-09
license: MIT
tags:
  - attack.stealth
  - attack.t1070.004

logsource:
  category: file_delete
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '23'

  selection_tool:
    Image|endswith:
      - '\sdelete.exe'
      - '\sdelete64.exe'
      - '\cipher.exe'

  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
      - '\Windows\Temp\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.vbs'
      - '.tmp'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and (selection_tool or selection_path) and not filter_system_account

falsepositives:
  - Legitimate use of sdelete/cipher for secure disk wiping during decommissioning, or routine cleanup of temp/installer files by software update processes; tune FilePathPattern allowlists if noise remains.

level: medium

T1070.004 Indicator Removal: File Deletion

title: "T1070.004 Indicator Removal: File Deletion"
id: cb31c575-df95-4c0a-b650-e8e8e041d8a0
description: 'Behavioral Detection of Malicious File Deletion. The prior primary selector (bare unlink/unlinkat/rmdir syscalls) matched virtually all routine file deletion on a system with no path or context filtering, making it a generic catch-all. Scoped the syscall selector to attacker-relevant, world-writable staging paths (/tmp, /dev/shm, /var/tmp) rather than alerting on any deletion anywhere on the filesystem. (Retargeted to the file_delete auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PathRegex, TimeWindow, SecureDeletionTool.'
references:
  - https://attack.mitre.org/techniques/T1070/004
author: Shahrukh Khan
date: 2026-05-09
license: MIT
tags:
  - attack.stealth
  - attack.t1070.004

logsource:
  category: file_delete
  product: linux

detection:
  selection:
    type: PATH
    nametype: DELETE
    name|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_secure:
    type: EXECVE
    a0|endswith:
      - '/shred'
      - '/srm'
      - '/wipe'

  condition: 1 of selection*

falsepositives:
  - Package uninstalls, temp-file cleanup cron jobs, and build pipelines routinely delete files under /tmp; secure-deletion tool usage (shred/srm) outside admin workflows is the stronger signal here.

level: medium

T1070.004 Indicator Removal: File Deletion

title: "T1070.004 Indicator Removal: File Deletion"
id: fdbacfb5-e7d6-45b4-bc74-a617461eb0e1
description: 'Behavioral Detection of Malicious File Deletion. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FilePathRegex, ToolUsageAnomaly.'
references:
  - https://attack.mitre.org/techniques/T1070/004
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.stealth
  - attack.t1070.004

logsource:
  category: file_change
  product: macos

detection:
  selection_targets:
    TargetFilename|contains:
      - '/Library/Logs/'
      - '.bash_history'
      - '.zsh_history'
      - '/private/var/db/diagnostics/'

  condition: selection_targets

falsepositives:
  - Log rotation and backup software also modify attributes on these same log and history paths, and the unified log does not expose a dedicated file-delete attribute change event, so this only approximates deletion activity.

level: medium

T1070.004 Indicator Removal: File Deletion

title: "T1070.004 Indicator Removal: File Deletion"
id: 23165ec7-8254-447c-be15-07993a144666
description: 'Behavioral Detection of Malicious File Deletion. (Retargeted to the file_delete ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LogFilePath, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1070/004
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
  - attack.stealth
  - attack.t1070.004

logsource:
  category: file_delete
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'rm -rf /var/log/'
      - 'rm -f /scratch/log/'

  condition: selection

falsepositives:
  - Log maintenance scripts and disk-space-recovery procedures performed by administrators can also delete log files under the same paths.

level: high

Related sub-techniques

Explore