Directory Removal Via Rmdir
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\cmd.exe" OR ORIGINALFILENAME = "Cmd.Exe") AND COMMANDLINE contains "rmdir" AND COMMANDLINE contains "/s,/q" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
