MITRE ATT&CK - Техника Удаление файлов

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Indicator Removal: Удаление файлов

Other sub-techniques of Indicator Removal (9)

ID	Название
.001	Очистка журналов событий Windows
.002	Очистка системных журналов Linux или Mac
.003	Очистка истории команд
.004	Удаление файлов
.005	Удаление подключений к общим сетевым ресурсам
.006	Изменение временных меток
.007	Очистка истории сетевых соединений и конфигураций
.008	Очистка почтового ящика
.009	Удаление индикаторов компрометации

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include del on Windows and rm or unlink on Linux and macOS.

ID: T1070.004

Относится к технике: T1070

Тактика(-и): Defense Evasion

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, File: File Deletion

Версия: 1.1

Дата создания: 31 Jan 2020

Последнее изменение: 16 Apr 2022

Название	Описание
Примеры процедур
TDTESS	TDTESS creates then deletes log files during installation of itself as a service.(Citation: ClearSky Wilted Tulip July 2017)
LightNeuron	LightNeuron has a function to delete files.(Citation: ESET LightNeuron May 2019)
ProLock	ProLock can remove files containing its payload after they are executed.(Citation: Group IB Ransomware September 2020)
Aquatic Panda	Aquatic Panda has deleted malicious executables from compromised machines.(Citation: CrowdStrike AQUATIC PANDA December 2021)
Denis	Denis has a command to delete files from the victim’s machine.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
Rising Sun	Rising Sun can delete files and artifacts it creates.(Citation: McAfee Sharpshooter December 2018)
FIN10	FIN10 has used batch scripts and scheduled tasks to delete critical system files.(Citation: FireEye FIN10 June 2017)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON can delete log files generated from the malware stored at `C:\windows\temp\tmp0207`.(Citation: CISA EB Aug 2020)
SamSam	SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.(Citation: Sophos SamSam Apr 2018)
SQLRat	SQLRat has used been observed deleting scripts once used.(Citation: Flashpoint FIN 7 March 2019)
menuPass	A menuPass macro deletes files after it has decoded and decompressed them.(Citation: Accenture Hogfish April 2018)(Citation: District Court of NY APT10 Indictment December 2018)
Heyoka Backdoor	Heyoka Backdoor has the ability to delete folders and files from a targeted system.(Citation: SentinelOne Aoqin Dragon June 2022)
BRONZE BUTLER	The BRONZE BUTLER uploader or malware the uploader uses `command` to delete the RAR archives after they have been exfiltrated.(Citation: Secureworks BRONZE BUTLER Oct 2017)
MacSpy	MacSpy deletes any temporary files it creates(Citation: alientvault macspy)
Tropic Trooper	Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)
AppleJeus	AppleJeus has deleted the MSI file after installation.(Citation: CISA AppleJeus Feb 2021)
Kivars	Kivars has the ability to uninstall malware from the infected host.(Citation: TrendMicro BlackTech June 2017)
TeamTNT	TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)
CSPY Downloader	CSPY Downloader has the ability to self delete.(Citation: Cybereason Kimsuky November 2020)
Azorult	Azorult can delete files from victim machines.(Citation: Unit42 Azorult Nov 2018)
DarkWatchman	DarkWatchman has been observed deleting its original launcher after installation.(Citation: Prevailion DarkWatchman 2021)
Bisonal	Bisonal will delete its dropper and VBS scripts from the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
APT38	APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)
RainyDay	RainyDay has the ability to uninstall itself by deleting its service and files.(Citation: Bitdefender Naikon April 2021)
Cherry Picker	Recent versions of Cherry Picker delete files and registry keys created by the malware.(Citation: Trustwave Cherry Picker)
Bankshot	Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.(Citation: McAfee Bankshot)
FIN5	FIN5 uses SDelete to clean up the environment and attempt to prevent detection.(Citation: Mandiant FIN5 GrrCON Oct 2016)
GreyEnergy	GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.(Citation: ESET GreyEnergy Oct 2018)
StoneDrill	StoneDrill has been observed deleting the temporary files once they fulfill their task.(Citation: Kaspersky StoneDrill 2017)
Backdoor.Oldrea	Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.(Citation: Symantec Dragonfly)
MESSAGETAP	Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk. (Citation: FireEye MESSAGETAP October 2019)
InvisiMole	InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Proton	Proton removes all files in the /tmp directory.(Citation: objsee mac malware 2017)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)
LockerGoga	LockerGoga has been observed deleting its original launcher after execution.(Citation: CarbonBlack LockerGoga 2019)
Machete	Once a file is uploaded, Machete will delete it from the machine.(Citation: ESET Machete July 2019)
MURKYTOP	MURKYTOP has the capability to delete local files.(Citation: FireEye Periscope March 2018)
Drovorub	Drovorub can delete specific files from a compromised host.(Citation: NSA/FBI Drovorub August 2020)
Gelsemium	Gelsemium can delete its dropper component from the targeted system.(Citation: ESET Gelsemium June 2021)
AuditCred	AuditCred can delete files from the system.(Citation: TrendMicro Lazarus Nov 2018)
Gold Dragon	Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.(Citation: McAfee Gold Dragon)
Remsec	Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)(Citation: Kaspersky ProjectSauron Technical Analysis)
Wingbird	Wingbird deletes its payload along with the payload's parent process after it finishes copying files.(Citation: Microsoft SIR Vol 21)
Imminent Monitor	Imminent Monitor has deleted files related to its dynamic debugger feature.(Citation: QiAnXin APT-C-36 Feb2019)
Mosquito	Mosquito deletes files using DeleteFileW API call.(Citation: ESET Turla Mosquito Jan 2018)
VERMIN	VERMIN can delete files on the victim’s machine.(Citation: Unit 42 VERMIN Jan 2018)
Pay2Key	Pay2Key can remove its log file from disk.(Citation: Check Point Pay2Key November 2020)
JPIN	JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.(Citation: Microsoft PLATINUM April 2016)
DustySky	DustySky can delete files it creates from the infected system.(Citation: Kaspersky MoleRATs April 2019)
Hildegard	Hildegard has deleted scripts after execution.(Citation: Unit 42 Hildegard Malware)
Epic	Epic has a command to delete a file from the machine.(Citation: Kaspersky Turla Aug 2014)
SDelete	SDelete deletes data in a way that makes it unrecoverable.(Citation: Microsoft SDelete July 2016)
Kazuar	Kazuar can delete files.(Citation: Unit 42 Kazuar May 2017)
PowerShower	PowerShower has the ability to remove all files created during the dropper process.(Citation: Unit 42 Inception November 2018)
Taidoor	Taidoor can use `DeleteFileA` to remove files from infected hosts.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
SUNSPOT	Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named `InventoryManager.bk` after restoring the original SolarWinds Orion source code to the software library.(Citation: CrowdStrike SUNSPOT Implant January 2021)
Komplex	The Komplex trojan supports file deletion.(Citation: Sofacy Komplex Trojan)
FALLCHILL	FALLCHILL can delete malware and associated artifacts from the victim.(Citation: US-CERT FALLCHILL Nov 2017)
	During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.(Citation: McAfee Honeybee)
Reaver	Reaver deletes the original dropped file from the victim.(Citation: Palo Alto Reaver Nov 2017)
Proxysvc	Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.(Citation: McAfee GhostSecret)
OopsIE	OopsIE has the capability to delete files and scripts from the victim's machine.(Citation: Unit 42 OilRig Sept 2018)
Stuxnet	Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.(Citation: Symantec W.32 Stuxnet Dossier)
jRAT	jRAT has a function to delete files from the victim’s machine.(Citation: jRAT Symantec Aug 2018)
KONNI	KONNI can delete files.(Citation: Talos Konni May 2017)
Dtrack	Dtrack can remove its persistence and delete itself.(Citation: Securelist Dtrack)
Ixeshe	Ixeshe has a command to delete a file from the machine.(Citation: Trend Micro IXESHE 2012)
DanBot	DanBot can delete its configuration file after installation.(Citation: ClearSky Siamesekitten August 2021)
HotCroissant	HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.(Citation: Carbon Black HotCroissant April 2020)
Crimson	Crimson has the ability to delete files from a compromised host.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
zwShell	zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.(Citation: McAfee Night Dragon)
njRAT	njRAT is capable of deleting files.(Citation: Fidelis njRAT June 2013)(Citation: Trend Micro njRAT 2018)
Kimsuky	Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)
IceApple	IceApple can delete files and directories from targeted systems.(Citation: CrowdStrike IceApple May 2022)
SombRAT	SombRAT has the ability to run `cancel` or `closeanddeletestorage` to remove all files from storage and delete the storage temp file on a compromised host.(Citation: BlackBerry CostaRicto November 2020)
OilRig	OilRig has deleted files associated with their payload after execution.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 OopsIE! Feb 2018)
ROKRAT	ROKRAT can request to delete files.(Citation: NCCGroup RokRat Nov 2018)
ADVSTORESHELL	ADVSTORESHELL can delete files and directories.(Citation: ESET Sednit Part 2)
Cuba	Cuba can use the command `cmd.exe /c del` to delete its artifacts from the system.(Citation: McAfee Cuba April 2021)
InnaputRAT	InnaputRAT has a command to delete files.(Citation: ASERT InnaputRAT April 2018)
FIN6	FIN6 has removed files from victim machines.(Citation: FireEye FIN6 April 2016)
APT41	APT41 deleted files from the system.(Citation: FireEye APT41 Aug 2019)
APT39	APT39 has used malware to delete files after they are deployed on a compromised host.(Citation: FBI FLASH APT39 September 2020)
APT29	APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Mandiant No Easy Breach)
Wizard Spider	Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.(Citation: CrowdStrike Grim Spider May 2019)
APT28	APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.(Citation: DOJ GRU Indictment Jul 2018)
APT18	APT18 actors deleted tools and batch files from victim systems.(Citation: Dell Lateral Movement)
Aria-body	Aria-body has the ability to delete files and directories on compromised hosts.(Citation: CheckPoint Naikon May 2020)
ccf32	ccf32 can delete files and folders from compromised machines.(Citation: Bitdefender FunnyDream Campaign November 2020)
Linfo	Linfo creates a backdoor through which remote attackers can delete files.(Citation: Symantec Linfo May 2012)
BLUELIGHT	BLUELIGHT can uninstall itself.(Citation: Volexity InkySquid BLUELIGHT August 2021)
Evilnum	Evilnum has deleted files used during infection.(Citation: ESET EvilNum July 2020)
Trojan.Karagany	Trojan.Karagany has used plugins with a self-delete capability.(Citation: Secureworks Karagany July 2019)
Metamorfo	Metamorfo has deleted itself from the system after execution.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)
FruitFly	FruitFly will delete files on the system.(Citation: objsee mac malware 2017)
Hi-Zor	Hi-Zor deletes its RAT installer file as it executes its DLL payload file.(Citation: Fidelis INOCNATION)
Cryptoistic	Cryptoistic has the ability delete files from a compromised host.(Citation: SentinelOne Lazarus macOS July 2020)
NanHaiShu	NanHaiShu launches a script to delete their original decoy file to cover tracks.(Citation: fsecure NanHaiShu July 2016)
WhisperGate	WhisperGate can delete tools from a compromised host after execution.(Citation: Cisco Ukraine Wipers January 2022)
RedLeaves	RedLeaves can delete specified files.(Citation: PWC Cloud Hopper Technical Annex April 2017)
OceanSalt	OceanSalt can delete files from the system.(Citation: McAfee Oceansalt Oct 2018)
SeaDuke	SeaDuke can securely delete files, including deleting itself from the victim.(Citation: Symantec Seaduke 2015)
Misdat	Misdat is capable of deleting the backdoor file.(Citation: Cylance Dust Storm)
BLINDINGCAN	BLINDINGCAN has deleted itself and associated artifacts from victim machines.(Citation: US-CERT BLINDINGCAN Aug 2020)
Dragonfly	Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.(Citation: US-CERT TA18-074A)
ShimRat	ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.(Citation: FOX-IT May 2016 Mofang)
BackConfig	BackConfig has the ability to remove files and folders related to previous infections.(Citation: Unit 42 BackConfig May 2020)
LiteDuke	LiteDuke can securely delete files by first writing random data to the file.(Citation: ESET Dukes October 2019)
MoonWind	MoonWind can delete itself or specified files.(Citation: Palo Alto MoonWind March 2017)
Mustang Panda	Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.(Citation: Secureworks BRONZE PRESIDENT December 2019)
Sandworm Team	Sandworm Team has used backdoors that can delete files used in an attack from an infected system.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)
More_eggs	More_eggs can remove itself from a system.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
PowerDuke	PowerDuke has a command to write random data across a file and delete it.(Citation: Volexity PowerDuke November 2016)
pngdowner	pngdowner deletes content from C2 communications that was saved to the user's temporary directory.(Citation: CrowdStrike Putter Panda)
Fysbis	Fysbis has the ability to delete files.(Citation: Fysbis Dr Web Analysis)
S-Type	S-Type has deleted files it has created on a compromised host.(Citation: Cylance Dust Storm)
StrongPity	StrongPity can delete previously exfiltrated files from the compromised host.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
	During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\\c$\windows\system32\devmgr.dll \\\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\\c$\windows\temp\LMAKSW.ps1`.(Citation: FoxIT Wocao December 2019)
ZxShell	ZxShell can delete files from the system.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)
Operation Wocao	Operation Wocao has deleted logs and executable files used during an intrusion.(Citation: FoxIT Wocao December 2019)
Magic Hound	Magic Hound has deleted and overwrote files to cover tracks.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)
APT32	APT32's macOS backdoor can receive a “delete” command.(Citation: ESET OceanLotus macOS April 2019)
RDFSNIFFER	RDFSNIFFER has the capability of deleting local files.(Citation: FireEye FIN7 Oct 2019)
RunningRAT	RunningRAT contains code to delete files from the victim’s machine.(Citation: McAfee Gold Dragon)
VBShower	VBShower has attempted to complicate forensic analysis by deleting all the files contained in `%APPDATA%\..\Local\Temporary Internet Files\Content.Word` and `%APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\`.(Citation: Kaspersky Cloud Atlas August 2019)
GuLoader	GuLoader can delete its executable from the `AppData\Local\Temp` directory on the compromised host.(Citation: Unit 42 NETWIRE April 2020)
Grandoreiro	Grandoreiro can delete .LNK files created in the Startup folder.(Citation: ESET Grandoreiro April 2020)
SILENTTRINITY	SILENTTRINITY can remove files from the compromised host.(Citation: GitHub SILENTTRINITY Modules July 2019)
Gazer	Gazer has commands to delete files and persistence mechanisms from the victim.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
FatDuke	FatDuke can secure delete its DLL.(Citation: ESET Dukes October 2019)
SpeakUp	SpeakUp deletes files to remove evidence on the machine. (Citation: CheckPoint SpeakUp Feb 2019)
Cobalt Group	Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.(Citation: Talos Cobalt Group July 2018)
Nebulae	Nebulae has the ability to delete files and directories.(Citation: Bitdefender Naikon April 2021)
GoldenSpy	GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.(Citation: Trustwave GoldenSpy2 June 2020)
Kevin	Kevin can delete files created on the victim's machine.(Citation: Kaspersky Lyceum October 2021)
CharmPower	CharmPower can delete created files from a compromised system.(Citation: Check Point APT35 CharmPower January 2022)
FIN8	FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
BBSRAT	BBSRAT can delete files and directories.(Citation: Palo Alto Networks BBSRAT)
PLEAD	PLEAD has the ability to delete files on the compromised host.(Citation: TrendMicro BlackTech June 2017)
LoudMiner	LoudMiner deleted installation files after completion.(Citation: ESET LoudMiner June 2019)
BabyShark	BabyShark has cleaned up all files associated with the secondary payload execution.(Citation: Unit42 BabyShark Apr 2019)
NOKKI	NOKKI can delete files to cover tracks.(Citation: Unit 42 NOKKI Sept 2018)
Lazarus Group	Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)
Green Lambert	Green Lambert can delete the original executable after initial installation in addition to unused functions.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Ursnif	Ursnif has deleted data staged in tmp files after exfiltration.(Citation: TrendMicro Ursnif Mar 2015)
APT3	APT3 has a tool that can delete files.(Citation: FireEye Clandestine Fox)
Hydraq	Hydraq creates a backdoor through which remote attackers can delete files.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
P.A.S. Webshell	P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.(Citation: ANSSI Sandworm January 2021)
Exaramel for Linux	Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.(Citation: ANSSI Sandworm January 2021)
The White Company	The White Company has the ability to delete its malware entirely from the target system.(Citation: Cylance Shaheen Nov 2018)
Sibot	Sibot will delete itself if a certain server response is received.(Citation: MSTIC NOBELIUM Mar 2021)
BLACKCOFFEE	BLACKCOFFEE has the capability to delete files.(Citation: FireEye APT17)
Cardinal RAT	Cardinal RAT can uninstall itself, including deleting its executable.(Citation: PaloAlto CardinalRat Apr 2017)
SysUpdate	SysUpdate can delete its configuration file from the targeted system.(Citation: Trend Micro Iron Tiger April 2021)
Derusbi	Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
RCSession	RCSession can remove files from a targeted system.(Citation: Profero APT27 December 2020)
Chimera	Chimera has performed file deletion to evade detection.(Citation: Cycraft Chimera April 2020)
LookBack	LookBack removes itself after execution and can delete files on the system.(Citation: Proofpoint LookBack Malware Aug 2019)
Dragonfly 2.0	Dragonfly 2.0 deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
Patchwork	Patchwork removed certain files and replaced them so they could not be retrieved.(Citation: TrendMicro Patchwork Dec 2017)
Group5	Malware used by Group5 is capable of remotely deleting files from victims.(Citation: Citizen Lab Group5)
Calisto	Calisto has the capability to use `rm -rf` to remove folders and files from the victim's machine.(Citation: Securelist Calisto July 2018)
PcShare	PcShare has deleted its files and components from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Seasalt	Seasalt has a command to delete a specified file.(Citation: Mandiant APT1 Appendix)
EvilBunny	EvilBunny has deleted the initial dropper after running through the environment checks.(Citation: Cyphort EvilBunny Dec 2014)
Elise	Elise is capable of launching a remote shell on the host to delete itself.(Citation: Accenture Dragonfish Jan 2018)
Shark	Shark can delete files downloaded to the compromised host.(Citation: ClearSky Siamesekitten August 2021)
gh0st RAT	gh0st RAT has the capability to to delete files.(Citation: FireEye Hacking Team)(Citation: Gh0stRAT ATT March 2019)
HTTPBrowser	HTTPBrowser deletes its original installer file once installation is complete.(Citation: ZScaler Hacking Team)
Winnti for Windows	Winnti for Windows can delete the DLLs for its various components from a compromised host.(Citation: Novetta Winnti April 2015)
UNC2452	UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.(Citation: FireEye SUNBURST Backdoor December 2020)
RDAT	RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.(Citation: Unit42 RDAT July 2020)
WINDSHIELD	WINDSHIELD is capable of file deletion along with other file system interaction.(Citation: FireEye APT32 May 2017)
ServHelper	ServHelper has a module to delete itself from the infected machine.(Citation: Proofpoint TA505 Jan 2019)(Citation: Deep Instinct TA505 Apr 2019)
QUADAGENT	QUADAGENT has a command to delete its Registry key and scheduled task.(Citation: Unit 42 QUADAGENT July 2018)
Zeus Panda	Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.(Citation: GDATA Zeus Panda June 2017)
Mori	Mori can delete its DLL file and related files by Registry value.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Gamaredon Group	Gamaredon Group tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)
Prikormka	After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.(Citation: ESET Operation Groundbait)
SUNBURST	SUNBURST had a command to delete files.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)
Okrum	Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.(Citation: ESET Okrum July 2019)
Bazar	Bazar can delete its loader using a batch file in the Windows temporary folder.(Citation: NCC Group Team9 June 2020)
POWERSTATS	POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.(Citation: FireEye MuddyWater Mar 2018)
Zebrocy	Zebrocy has a command to delete files and directories.(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019)(Citation: CISA Zebrocy Oct 2020)
OutSteel	OutSteel can delete itself following the successful execution of a follow-on payload.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Pasam	Pasam creates a backdoor through which remote attackers can delete files.(Citation: Symantec Pasam May 2012)
KillDisk	KillDisk has the ability to quit and delete itself.(Citation: ESET Telebots Dec 2016)
Pteranodon	Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.(Citation: Palo Alto Gamaredon Feb 2017)
PUNCHBUGGY	PUNCHBUGGY can delete files written to disk.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Morphisec ShellTea June 2019)
Ferocious	Ferocious can delete files from a compromised host.(Citation: Kaspersky WIRTE November 2021)
Silence	Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)
Bandook	Bandook has a command to delete a file.(Citation: CheckPoint Bandook Nov 2020)
AppleSeed	AppleSeed can delete files from a compromised host after they are exfiltrated.(Citation: Malwarebytes Kimsuky June 2021)
HALFBAKED	HALFBAKED can delete a specified file.(Citation: FireEye FIN7 April 2017)
HermeticWiper	HermeticWiper has the ability to overwrite its own file with random bites.(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)
Carbanak	Carbanak has a command to delete files.(Citation: FireEye CARBANAK June 2017)
Pillowmint	Pillowmint has deleted the filepath `%APPDATA%\Intel\devmonsrv.exe`.(Citation: Trustwave Pillowmint June 2020)
WindTail	WindTail has the ability to receive and execute a self-delete command.(Citation: objective-see windtail2 jan 2019)
TAINTEDSCRIBE	TAINTEDSCRIBE can delete files from a compromised host.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Attor	Attor’s plugin deletes the collected files and log files after exfiltration.(Citation: ESET Attor Oct 2019)
Anchor	Anchor can self delete its dropper after the malware is successfully deployed.(Citation: Cyberreason Anchor December 2019)
Lokibot	Lokibot will delete its dropped files after bypassing UAC.(Citation: Talos Lokibot Jan 2021)
TEMP.Veles	TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.(Citation: FireEye TRITON 2019)
cmd	cmd can be used to delete files from the file system.(Citation: TechNet Del)
HyperBro	HyperBro has the ability to delete a specified file.(Citation: Unit42 Emissary Panda May 2019)
Milan	Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.(Citation: ClearSky Siamesekitten August 2021)
Rocke	Rocke has deleted files on infected machines.(Citation: Anomali Rocke March 2019)
KEYMARBLE	KEYMARBLE has the capability to delete files off the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)
GrimAgent	GrimAgent can delete old binaries on a compromised host.(Citation: Group IB GrimAgent July 2021)
Sakula	Some Sakula samples use cmd.exe to delete temporary files.(Citation: Dell Sakula)
PyDCrypt	PyDCrypt will remove all created artifacts such as dropped executables.(Citation: Checkpoint MosesStaff Nov 2021)
USBStealer	USBStealer has several commands to delete files associated with the malware from the victim.(Citation: ESET Sednit USBStealer 2014)
REvil	REvil can mark its binary code for deletion after reboot.(Citation: Intel 471 REvil March 2020)
HAWKBALL	HAWKBALL has the ability to delete files.(Citation: FireEye HAWKBALL Jun 2019)
Threat Group-3390	Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)
CARROTBAT	CARROTBAT has the ability to delete downloaded files from a compromised host.(Citation: Unit 42 CARROTBAT November 2018)
JHUHUGIT	The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)
Meteor	Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.(Citation: Check Point Meteor Aug 2021)
PoetRAT	PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.(Citation: Talos PoetRAT April 2020)
Bumblebee	Bumblebee can uninstall its loader through the use of a `Sdl` command.(Citation: Proofpoint Bumblebee April 2022)
Pony	Pony has used scripts to delete itself after execution.(Citation: Malwarebytes Pony April 2016)
FlawedAmmyy	FlawedAmmyy can execute batch scripts to delete files.(Citation: Korean FSI TA505 2020)
StrifeWater	StrifeWater can self delete to cover its tracks.(Citation: Cybereason StrifeWater Feb 2022)
Penquin	Penquin can delete downloaded executables after running them.(Citation: Leonardo Turla Penquin May 2020)
Honeybee	Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.(Citation: McAfee Honeybee)
Hancitor	Hancitor has deleted files using the VBA `kill` function.(Citation: FireEye Hancitor)
XAgentOSX	XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.(Citation: XAgentOSX 2017)
TYPEFRAME	TYPEFRAME can delete files off the system.(Citation: US-CERT TYPEFRAME June 2018)
Saint Bot	Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
MacMa	MacMa can delete itself from the compromised computer.(Citation: ESET DazzleSpy Jan 2022)
SDBbot	SDBbot has the ability to delete files from a compromised host.(Citation: Proofpoint TA505 October 2019)
Volgmer	Volgmer can delete files and itself after infection to avoid analysis.(Citation: US-CERT Volgmer 2 Nov 2017)
FELIXROOT	FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.(Citation: FireEye FELIXROOT July 2018)
FunnyDream	FunnyDream can delete files including its dropper component.(Citation: Bitdefender FunnyDream Campaign November 2020)
Pysa	Pysa has deleted batch files after execution. (Citation: CERT-FR PYSA April 2020)
RTM	RTM can delete all files created during its execution.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
QakBot	QakBot can delete folders and files including overwriting its executable with legitimate programs.(Citation: Kroll Qakbot June 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: ATT QakBot April 2021)(Citation: Group IB Ransomware September 2020)

Контрмера	Описание
Контрмеры
File Deletion Mitigation	Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to delete files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.