Backup Files Deleted
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "File deleted" AND (PROCESSNAME endswith "\explorer.exe,\cmd.exe,\powershell.exe,\powershell_ise.exe,\pwsh.exe,\wt.exe,\rundll32.exe,\regsvr32.exe" AND (OBJECTNAME endswith ".VHD,.bac,.bak,.wbcat,.bkf,.set,.win,.dsk" OR FILENAME endswith ".VHD,.bac,.bak,.wbcat,.bkf,.set,.win,.dsk"))
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.PROCESSNAME,Action1.ACCESSLIST,Action1.OBJECTNAME,Action1.FILENAME,Action1.FILETYPE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@frack113
