File Deletion T1070.004

Delete a single file from the temporary directory

rm -f #{file_to_delete}

rm -rf #{parent_folder}

test -e #{file_to_delete} && exit 0 || exit 1

mkdir -p #{parent_folder} && touch #{file_to_delete}

Recursively delete the temporary directory and all files contained within it

rm -rf #{folder_to_delete}

test -e #{folder_to_delete} && exit 0 || exit 1

mkdir -p #{folder_to_delete}

Use the shred command to overwrite the temporary file and then delete it

shred -u #{file_to_shred}

if [ -f "#{file_to_shred}" ]; then echo "File already exists"; else echo "File does NOT exist yet"; exit 1; fi

touch #{file_to_shred}

Delete a single file from the temporary directory using cmd.exe. Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.

del /f #{file_to_delete}

IF EXIST "#{file_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 )

echo deleteme_T1551.004 >> #{file_to_delete}

Recursively delete a folder in the temporary directory using cmd.exe. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.

rmdir /s /q #{folder_to_delete}

IF EXIST "#{folder_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 )

mkdir #{folder_to_delete}

Delete a single file from the temporary directory using Powershell. Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.

Remove-Item -path #{file_to_delete}

if (Test-Path #{file_to_delete}) {exit 0} else {exit 1}

New-Item -Path #{file_to_delete} | Out-Null

Recursively delete a folder in the temporary directory using Powershell. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.

Remove-Item -Path #{folder_to_delete} -Recurse

if (Test-Path #{folder_to_delete}) {exit 0} else {exit 1}

New-Item -Path #{folder_to_delete} -Type Directory | Out-Null

This test deletes the entire root filesystem of a Linux system. This technique was used by Amnesia IoT malware to avoid analysis. This test is dangerous and destructive, do NOT use on production equipment.

[ "$(uname)" = 'Linux' ] && rm -rf / --no-preserve-root > /dev/null 2> /dev/null || chflags -R 0 / && rm -rf / > /dev/null 2> /dev/null

Delete a single prefetch file. Deletion of prefetch files is a known anti-forensic technique. To verify execution, Run (Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" | Measure-Object).Count before and after the test to verify that the number of prefetch files decreases by 1.

Remove-Item -Path (Join-Path "$Env:SystemRoot\prefetch\" (Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" -Name)[0])

Adversaries may delete TeamViewer log files to hide activity. This should provide a high true-positive alert ration. This test just places the files in a non-TeamViewer folder, a detection would just check for a deletion event matching the TeamViewer log file format of TeamViewer_##.log. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted. https://twitter.com/SBousseaden/status/1197524463304290305?s=20

New-Item -Path #{teamviewer_log_file} -Force | Out-Null
Remove-Item #{teamviewer_log_file} -Force -ErrorAction Ignore

An adversary clears the recycle bin in the system partition using rd to remove traces of deleted files. Reference

rd /s /q %systemdrive%\$RECYCLE.BIN