Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Indicator Removal: Удаление файлов

Other sub-techniques of Indicator Removal (10)

ID	Название
.001	Очистка журналов событий Windows
.002	Очистка системных журналов Linux или Mac
.003	Очистка истории команд
.004	Удаление файлов
.005	Удаление подключений к общим сетевым ресурсам
.006	Изменение временных меток
.007	Очистка истории сетевых соединений и конфигураций
.008	Очистка почтового ящика
.009	Удаление индикаторов компрометации
.010	Relocate Malware

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and `rm` on ESXi.

ID: T1070.004

Относится к технике: T1070

Тактика(-и): Defense Evasion

Платформы: ESXi, Linux, Windows, macOS

Источники данных: Command: Command Execution, File: File Deletion

Версия: 1.2

Дата создания: 31 Jan 2020

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
PowerDuke	PowerDuke has a command to write random data across a file and delete it.(Citation: Volexity PowerDuke November 2016)
BLINDINGCAN	BLINDINGCAN has deleted itself and associated artifacts from victim machines.(Citation: US-CERT BLINDINGCAN Aug 2020)
RCSession	RCSession can remove files from a targeted system.(Citation: Profero APT27 December 2020)
Bumblebee	Bumblebee can uninstall its loader through the use of a `Sdl` command.(Citation: Proofpoint Bumblebee April 2022)
MURKYTOP	MURKYTOP has the capability to delete local files.(Citation: FireEye Periscope March 2018)
RDFSNIFFER	RDFSNIFFER has the capability of deleting local files.(Citation: FireEye FIN7 Oct 2019)
NICECURL	NICECURL has a function to remove artifacts.(Citation: Mandiant APT42-untangling)
Proxysvc	Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.(Citation: McAfee GhostSecret)
NOKKI	NOKKI can delete files to cover tracks.(Citation: Unit 42 NOKKI Sept 2018)
Backdoor.Oldrea	Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.(Citation: Symantec Dragonfly)
Stuxnet	Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
VersaMem	VersaMem deleted files related to initial installation such as temporary files related to the PID of the main web process.(Citation: Lumen Versa 2024)
TDTESS	TDTESS creates then deletes log files during installation of itself as a service.(Citation: ClearSky Wilted Tulip July 2017)
COATHANGER	COATHANGER removes files from victim environments following use in multiple instances.(Citation: NCSC-NL COATHANGER Feb 2024)
HALFBAKED	HALFBAKED can delete a specified file.(Citation: FireEye FIN7 April 2017)
WindTail	WindTail has the ability to receive and execute a self-delete command.(Citation: objective-see windtail2 jan 2019)
Misdat	Misdat is capable of deleting the backdoor file.(Citation: Cylance Dust Storm)
Exaramel for Linux	Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.(Citation: ANSSI Sandworm January 2021)
KEYMARBLE	KEYMARBLE has the capability to delete files off the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)
SILENTTRINITY	SILENTTRINITY can remove files from the compromised host.(Citation: GitHub SILENTTRINITY Modules July 2019)
HAWKBALL	HAWKBALL has the ability to delete files.(Citation: FireEye HAWKBALL Jun 2019)
Ursnif	Ursnif has deleted data staged in tmp files after exfiltration.(Citation: TrendMicro Ursnif Mar 2015)
RansomHub	RansomHub has the ability to self-delete.(Citation: Group-IB RansomHub FEB 2025)
RedLeaves	RedLeaves can delete specified files.(Citation: PWC Cloud Hopper Technical Annex April 2017)
Zeus Panda	Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.(Citation: GDATA Zeus Panda June 2017)
CARROTBAT	CARROTBAT has the ability to delete downloaded files from a compromised host.(Citation: Unit 42 CARROTBAT November 2018)
Bankshot	Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.(Citation: McAfee Bankshot)
StrongPity	StrongPity can delete previously exfiltrated files from the compromised host.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
Pony	Pony has used scripts to delete itself after execution.(Citation: Malwarebytes Pony April 2016)
Nebulae	Nebulae has the ability to delete files and directories.(Citation: Bitdefender Naikon April 2021)
AuditCred	AuditCred can delete files from the system.(Citation: TrendMicro Lazarus Nov 2018)
UPSTYLE	UPSTYLE removes `bootstrap.min.css` after parsing command and control instructions, restoring the file to its original state.(Citation: Volexity UPSTYLE 2024)
OceanSalt	OceanSalt can delete files from the system.(Citation: McAfee Oceansalt Oct 2018)
RainyDay	RainyDay has the ability to uninstall itself by deleting its service and files.(Citation: Bitdefender Naikon April 2021)
AppleSeed	AppleSeed can delete files from a compromised host after they are exfiltrated.(Citation: Malwarebytes Kimsuky June 2021)
PyDCrypt	PyDCrypt will remove all created artifacts such as dropped executables.(Citation: Checkpoint MosesStaff Nov 2021)
GreyEnergy	GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.(Citation: ESET GreyEnergy Oct 2018)
Gomir	Gomir deletes its original executable and terminates its original process after creating a systemd service.(Citation: Symantec Troll Stealer 2024)
Aria-body	Aria-body has the ability to delete files and directories on compromised hosts.(Citation: CheckPoint Naikon May 2020)
BOLDMOVE	BOLDMOVE can remove files on victim systems.(Citation: Google Cloud BOLDMOVE 2023)
Crimson	Crimson has the ability to delete files from a compromised host.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
BADHATCH	BADHATCH has the ability to delete PowerShell scripts from a compromised machine.(Citation: Gigamon BADHATCH Jul 2019)
Machete	Once a file is uploaded, Machete will delete it from the machine.(Citation: ESET Machete July 2019)
Prikormka	After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.(Citation: ESET Operation Groundbait)
PcShare	PcShare has deleted its files and components from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Woody RAT	Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.(Citation: MalwareBytes WoodyRAT Aug 2022)
ShrinkLocker	ShrinkLocker can delete itself depending on various checks performed during execution.(Citation: Kaspersky ShrinkLocker 2024)
Hildegard	Hildegard has deleted scripts after execution.(Citation: Unit 42 Hildegard Malware)
SombRAT	SombRAT has the ability to run `cancel` or `closeanddeletestorage` to remove all files from storage and delete the storage temp file on a compromised host.(Citation: BlackBerry CostaRicto November 2020)
ODAgent	ODAgent can delete payloads and files used to pass C2 commands from remotely hosted cloud accounts.(Citation: ESET OilRig Downloaders DEC 2023)
BlackByte 2.0 Ransomware	BlackByte 2.0 Ransomware deletes itself following device encryption.(Citation: Microsoft BlackByte 2023)
FlawedAmmyy	FlawedAmmyy can execute batch scripts to delete files.(Citation: Korean FSI TA505 2020)
GuLoader	GuLoader can delete its executable from the `AppData\Local\Temp` directory on the compromised host.(Citation: Unit 42 NETWIRE April 2020)
ProLock	ProLock can remove files containing its payload after they are executed.(Citation: Group IB Ransomware September 2020)
InvisiMole	InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
P.A.S. Webshell	P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.(Citation: ANSSI Sandworm January 2021)
Apostle	Apostle writes batch scripts to disk, such as `system.bat` and `remover.bat`, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.(Citation: SentinelOne Agrius 2021)
Volgmer	Volgmer can delete files and itself after infection to avoid analysis.(Citation: US-CERT Volgmer 2 Nov 2017)
WhisperGate	WhisperGate can delete tools from a compromised host after execution.(Citation: Cisco Ukraine Wipers January 2022)
FruitFly	FruitFly will delete files on the system.(Citation: objsee mac malware 2017)
AcidPour	AcidPour includes a self-delete function where the malware deletes itself from disk after execution and program load into memory.(Citation: SentinelOne AcidPour 2024)
RDAT	RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.(Citation: Unit42 RDAT July 2020)
Okrum	Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.(Citation: ESET Okrum July 2019)
SamSam	SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.(Citation: Sophos SamSam Apr 2018)
Raspberry Robin	Raspberry Robin can delete its initial delivery script from disk during execution.(Citation: HP RaspberryRobin 2024)
Fysbis	Fysbis has the ability to delete files.(Citation: Fysbis Dr Web Analysis)
VERMIN	VERMIN can delete files on the victim’s machine.(Citation: Unit 42 VERMIN Jan 2018)
Nightdoor	Nightdoor can self-delete.(Citation: ESET EvasivePanda 2024)
CSPY Downloader	CSPY Downloader has the ability to self delete.(Citation: Cybereason Kimsuky November 2020)
PowerShower	PowerShower has the ability to remove all files created during the dropper process.(Citation: Unit 42 Inception November 2018)
Kazuar	Kazuar can delete files.(Citation: Unit 42 Kazuar May 2017)
FatDuke	FatDuke can secure delete its DLL.(Citation: ESET Dukes October 2019)
zwShell	zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.(Citation: McAfee Night Dragon)
Rising Sun	Rising Sun can delete files and artifacts it creates.(Citation: McAfee Sharpshooter December 2018)
ShimRat	ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.(Citation: FOX-IT May 2016 Mofang)
Hi-Zor	Hi-Zor deletes its RAT installer file as it executes its DLL payload file.(Citation: Fidelis INOCNATION)
XAgentOSX	XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.(Citation: XAgentOSX 2017)
Green Lambert	Green Lambert can delete the original executable after initial installation in addition to unused functions.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
LockerGoga	LockerGoga has been observed deleting its original launcher after execution.(Citation: CarbonBlack LockerGoga 2019)
PUNCHBUGGY	PUNCHBUGGY can delete files written to disk.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Morphisec ShellTea June 2019)
HyperBro	HyperBro has the ability to delete a specified file.(Citation: Unit42 Emissary Panda May 2019)
Anchor	Anchor can self delete its dropper after the malware is successfully deployed.(Citation: Cyberreason Anchor December 2019)
Line Runner	Line Runner removes its initial ZIP delivery archive after processing the enclosed LUA script.(Citation: Cisco ArcaneDoor 2024)
Pteranodon	Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.(Citation: Palo Alto Gamaredon Feb 2017)
ROKRAT	ROKRAT can request to delete files.(Citation: NCCGroup RokRat Nov 2018)
RunningRAT	RunningRAT contains code to delete files from the victim’s machine.(Citation: McAfee Gold Dragon)
Exbyte	Exbyte will self-delete if a hard-coded configuration file is not found.(Citation: Microsoft BlackByte 2023)
DarkWatchman	DarkWatchman has been observed deleting its original launcher after installation.(Citation: Prevailion DarkWatchman 2021)
BBSRAT	BBSRAT can delete files and directories.(Citation: Palo Alto Networks BBSRAT)
Reaver	Reaver deletes the original dropped file from the victim.(Citation: Palo Alto Reaver Nov 2017)
Bisonal	Bisonal will delete its dropper and VBS scripts from the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
MultiLayer Wiper	MultiLayer Wiper uses a batch file, `remover.bat` to delete malware artifacts and the batch file itself during execution.(Citation: Unit42 Agrius 2023)
S-Type	S-Type has deleted files it has created on a compromised host.(Citation: Cylance Dust Storm)
SeaDuke	SeaDuke can securely delete files, including deleting itself from the victim.(Citation: Symantec Seaduke 2015)
DustySky	DustySky can delete files it creates from the infected system.(Citation: Kaspersky MoleRATs April 2019)
Remsec	Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)(Citation: Kaspersky ProjectSauron Technical Analysis)
Epic	Epic has a command to delete a file from the machine.(Citation: Kaspersky Turla Aug 2014)
LightNeuron	LightNeuron has a function to delete files.(Citation: ESET LightNeuron May 2019)
Cuba	Cuba can use the command `cmd.exe /c del` to delete its artifacts from the system.(Citation: McAfee Cuba April 2021)
DarkGate	DarkGate has deleted its staging directories.(Citation: Rapid7 BlackBasta 2024)
NanHaiShu	NanHaiShu launches a script to delete their original decoy file to cover tracks.(Citation: fsecure NanHaiShu July 2016)
LockBit 3.0	LockBit 3.0 can delete itself from disk.(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)
Carbanak	Carbanak has a command to delete files.(Citation: FireEye CARBANAK June 2017)
Hydraq	Hydraq creates a backdoor through which remote attackers can delete files.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
Ferocious	Ferocious can delete files from a compromised host.(Citation: Kaspersky WIRTE November 2021)
Elise	Elise is capable of launching a remote shell on the host to delete itself.(Citation: Accenture Dragonfish Jan 2018)
Gazer	Gazer has commands to delete files and persistence mechanisms from the victim.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
Latrodectus	Latrodectus has the ability to delete itself.(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)
Saint Bot	Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Pay2Key	Pay2Key can remove its log file from disk.(Citation: Check Point Pay2Key November 2020)
CharmPower	CharmPower can delete created files from a compromised system.(Citation: Check Point APT35 CharmPower January 2022)
TYPEFRAME	TYPEFRAME can delete files off the system.(Citation: US-CERT TYPEFRAME June 2018)
Mori	Mori can delete its DLL file and related files by Registry value.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
QUADAGENT	QUADAGENT has a command to delete its Registry key and scheduled task.(Citation: Unit 42 QUADAGENT July 2018)
TAINTEDSCRIBE	TAINTEDSCRIBE can delete files from a compromised host.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
pngdowner	pngdowner deletes content from C2 communications that was saved to the user's temporary directory.(Citation: CrowdStrike Putter Panda)
Uroburos	Uroburos can run a `Clear Agents Track` command on an infected machine to delete Uroburos-related logs.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Metamorfo	Metamorfo has deleted itself from the system after execution.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)
Trojan.Karagany	Trojan.Karagany has used plugins with a self-delete capability.(Citation: Secureworks Karagany July 2019)
Bandook	Bandook has a command to delete a file.(Citation: CheckPoint Bandook Nov 2020)
MagicRAT	MagicRAT can delete files on victim systems, including itself.(Citation: Cisco MagicRAT 2022)
KONNI	KONNI can delete files.(Citation: Talos Konni May 2017)
gh0st RAT	gh0st RAT has the capability to to delete files.(Citation: FireEye Hacking Team)(Citation: Gh0stRAT ATT March 2019)
JHUHUGIT	The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)
BLUELIGHT	BLUELIGHT can uninstall itself.(Citation: Volexity InkySquid BLUELIGHT August 2021)
Ixeshe	Ixeshe has a command to delete a file from the machine.(Citation: Trend Micro IXESHE 2012)
VBShower	VBShower has attempted to complicate forensic analysis by deleting all the files contained in `%APPDATA%\..\Local\Temporary Internet Files\Content.Word` and `%APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\`.(Citation: Kaspersky Cloud Atlas August 2019)
BPFDoor	After initial setup, BPFDoor's original execution process deletes the dropped binary and exits.(Citation: Sandfly BPFDoor 2022)
ZeroCleare	ZeroCleare has the ability to uninstall the RawDisk driver and delete the `rwdsk` file on disk.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)
StoneDrill	StoneDrill has been observed deleting the temporary files once they fulfill their task.(Citation: Kaspersky StoneDrill 2017)
OopsIE	OopsIE has the capability to delete files and scripts from the victim's machine.(Citation: Unit 42 OilRig Sept 2018)
Attor	Attor’s plugin deletes the collected files and log files after exfiltration.(Citation: ESET Attor Oct 2019)
Imminent Monitor	Imminent Monitor has deleted files related to its dynamic debugger feature.(Citation: QiAnXin APT-C-36 Feb2019)
SQLRat	SQLRat has used been observed deleting scripts once used.(Citation: Flashpoint FIN 7 March 2019)
SDBbot	SDBbot has the ability to delete files from a compromised host.(Citation: Proofpoint TA505 October 2019)
Mosquito	Mosquito deletes files using DeleteFileW API call.(Citation: ESET Turla Mosquito Jan 2018)
RTM	RTM can delete all files created during its execution.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
Derusbi	Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
Grandoreiro	Grandoreiro can delete .LNK files created in the Startup folder.(Citation: ESET Grandoreiro April 2020)
LiteDuke	LiteDuke can securely delete files by first writing random data to the file.(Citation: ESET Dukes October 2019)
Sakula	Some Sakula samples use cmd.exe to delete temporary files.(Citation: Dell Sakula)
Sibot	Sibot will delete itself if a certain server response is received.(Citation: MSTIC NOBELIUM Mar 2021)
WINDSHIELD	WINDSHIELD is capable of file deletion along with other file system interaction.(Citation: FireEye APT32 May 2017)
Drovorub	Drovorub can delete specific files from a compromised host.(Citation: NSA/FBI Drovorub August 2020)
Shark	Shark can delete files downloaded to the compromised host.(Citation: ClearSky Siamesekitten August 2021)
Bazar	Bazar can delete its loader using a batch file in the Windows temporary folder.(Citation: NCC Group Team9 June 2020)
MESSAGETAP	Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk. (Citation: FireEye MESSAGETAP October 2019)
XLoader	XLoader can delete malicious executables from compromised machines.(Citation: Acronis XLoader 2021)
MoonWind	MoonWind can delete itself or specified files.(Citation: Palo Alto MoonWind March 2017)
Cryptoistic	Cryptoistic has the ability delete files from a compromised host.(Citation: SentinelOne Lazarus macOS July 2020)
HermeticWiper	HermeticWiper has the ability to overwrite its own file with random bites.(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)
Pysa	Pysa has deleted batch files after execution. (Citation: CERT-FR PYSA April 2020)
ccf32	ccf32 can delete files and folders from compromised machines.(Citation: Bitdefender FunnyDream Campaign November 2020)
LockBit 2.0	LockBit 2.0 can delete itself from disk after execution.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)(Citation: Cybereason Lockbit 2.0)
Zebrocy	Zebrocy has a command to delete files and directories.(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019)(Citation: CISA Zebrocy Oct 2020)
SpeakUp	SpeakUp deletes files to remove evidence on the machine. (Citation: CheckPoint SpeakUp Feb 2019)
LunarMail	LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one.(Citation: ESET Turla Lunar toolset May 2024)
SUNBURST	SUNBURST had a command to delete files.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)
EvilBunny	EvilBunny has deleted the initial dropper after running through the environment checks.(Citation: Cyphort EvilBunny Dec 2014)
Wingbird	Wingbird deletes its payload along with the payload's parent process after it finishes copying files.(Citation: Microsoft SIR Vol 21)
HotCroissant	HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.(Citation: Carbon Black HotCroissant April 2020)
ServHelper	ServHelper has a module to delete itself from the infected machine.(Citation: Proofpoint TA505 Jan 2019)(Citation: Deep Instinct TA505 Apr 2019)
REvil	REvil can mark its binary code for deletion after reboot.(Citation: Intel 471 REvil March 2020)
Milan	Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.(Citation: ClearSky Siamesekitten August 2021)
USBStealer	USBStealer has several commands to delete files associated with the malware from the victim.(Citation: ESET Sednit USBStealer 2014)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: Unit42 OceanLotus 2017)
Taidoor	Taidoor can use `DeleteFileA` to remove files from infected hosts.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
Cherry Picker	Recent versions of Cherry Picker delete files and registry keys created by the malware.(Citation: Trustwave Cherry Picker)
Kivars	Kivars has the ability to uninstall malware from the infected host.(Citation: TrendMicro BlackTech June 2017)
Seasalt	Seasalt has a command to delete a specified file.(Citation: Mandiant APT1 Appendix)
Pasam	Pasam creates a backdoor through which remote attackers can delete files.(Citation: Symantec Pasam May 2012)
PLEAD	PLEAD has the ability to delete files on the compromised host.(Citation: TrendMicro BlackTech June 2017)
Raccoon Stealer	Raccoon Stealer can remove files related to use and installation.(Citation: Sekoia Raccoon1 2022)
IPsec Helper	IPsec Helper can delete itself when given the appropriate command.(Citation: SentinelOne Agrius 2021)
Cardinal RAT	Cardinal RAT can uninstall itself, including deleting its executable.(Citation: PaloAlto CardinalRat Apr 2017)
DanBot	DanBot can delete its configuration file after installation.(Citation: ClearSky Siamesekitten August 2021)
Calisto	Calisto has the capability to use `rm -rf` to remove folders and files from the victim's machine.(Citation: Securelist Calisto July 2018)
Solar	Solar has the ability to delete staged files after they are uploaded to C2.(Citation: ESET OilRig Campaigns Sep 2023)
GoldenSpy	GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.(Citation: Trustwave GoldenSpy2 June 2020)
Gold Dragon	Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.(Citation: McAfee Gold Dragon)
cmd	cmd can be used to delete files from the file system.(Citation: TechNet Del)
Pillowmint	Pillowmint has deleted the filepath `%APPDATA%\Intel\devmonsrv.exe`.(Citation: Trustwave Pillowmint June 2020)
MacMa	MacMa can delete itself from the compromised computer.(Citation: ESET DazzleSpy Jan 2022)
FunnyDream	FunnyDream can delete files including its dropper component.(Citation: Bitdefender FunnyDream Campaign November 2020)
ROADSWEEP	ROADSWEEP can use embedded scripts to remove itself from the infected host.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)
SUNSPOT	Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named `InventoryManager.bk` after restoring the original SolarWinds Orion source code to the software library.(Citation: CrowdStrike SUNSPOT Implant January 2021)
More_eggs	More_eggs can remove itself from a system.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
SysUpdate	SysUpdate can delete its configuration file from the targeted system.(Citation: Trend Micro Iron Tiger April 2021)
OutSteel	OutSteel can delete itself following the successful execution of a follow-on payload.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
BackConfig	BackConfig has the ability to remove files and folders related to previous infections.(Citation: Unit 42 BackConfig May 2020)
Proton	Proton removes all files in the /tmp directory.(Citation: objsee mac malware 2017)
InnaputRAT	InnaputRAT has a command to delete files.(Citation: ASERT InnaputRAT April 2018)
GrimAgent	GrimAgent can delete old binaries on a compromised host.(Citation: Group IB GrimAgent July 2021)
LookBack	LookBack removes itself after execution and can delete files on the system.(Citation: Proofpoint LookBack Malware Aug 2019)
Lokibot	Lokibot will delete its dropped files after bypassing UAC.(Citation: Talos Lokibot Jan 2021)
PoetRAT	PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.(Citation: Talos PoetRAT April 2020)
StealBit	StealBit can self-delete its executable file from the compromised system.(Citation: Cybereason StealBit Exfiltration Tool)(Citation: FBI Lockbit 2.0 FEB 2022)
FELIXROOT	FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.(Citation: FireEye FELIXROOT July 2018)
ZxShell	ZxShell can delete files from the system.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)
Penquin	Penquin can delete downloaded executables after running them.(Citation: Leonardo Turla Penquin May 2020)
BabyShark	BabyShark has cleaned up all files associated with the secondary payload execution.(Citation: Unit42 BabyShark Apr 2019)
Winnti for Windows	Winnti for Windows can delete the DLLs for its various components from a compromised host.(Citation: Novetta Winnti April 2015)
Troll Stealer	Troll Stealer creates and can execute a BAT script that will delete the malware.(Citation: S2W Troll Stealer 2024)
BLACKCOFFEE	BLACKCOFFEE has the capability to delete files.(Citation: FireEye APT17)
Meteor	Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.(Citation: Check Point Meteor Aug 2021)
SDelete	SDelete deletes data in a way that makes it unrecoverable.(Citation: Microsoft SDelete July 2016)
njRAT	njRAT is capable of deleting files.(Citation: Fidelis njRAT June 2013)(Citation: Trend Micro njRAT 2018)
POWERSTATS	POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.(Citation: FireEye MuddyWater Mar 2018)
IceApple	IceApple can delete files and directories from targeted systems.(Citation: CrowdStrike IceApple May 2022)
JPIN	JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.(Citation: Microsoft PLATINUM April 2016)
metaMain	metaMain has deleted collected items after uploading the content to its C2 server.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Heyoka Backdoor	Heyoka Backdoor has the ability to delete folders and files from a targeted system.(Citation: SentinelOne Aoqin Dragon June 2022)
HTTPBrowser	HTTPBrowser deletes its original installer file once installation is complete.(Citation: ZScaler Hacking Team)
LunarWeb	LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.(Citation: ESET Turla Lunar toolset May 2024)
KillDisk	KillDisk has the ability to quit and delete itself.(Citation: ESET Telebots Dec 2016)
AppleJeus	AppleJeus has deleted the MSI file after installation.(Citation: CISA AppleJeus Feb 2021)
Kevin	Kevin can delete files created on the victim's machine.(Citation: Kaspersky Lyceum October 2021)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON can delete log files generated from the malware stored at `C:\windows\temp\tmp0207`.(Citation: CISA EB Aug 2020)
Linfo	Linfo creates a backdoor through which remote attackers can delete files.(Citation: Symantec Linfo May 2012)
QakBot	QakBot can delete folders and files including overwriting its executable with legitimate programs.(Citation: Kroll Qakbot June 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: ATT QakBot April 2021)(Citation: Group IB Ransomware September 2020)
Hancitor	Hancitor has deleted files using the VBA `kill` function.(Citation: FireEye Hancitor)
Gelsemium	Gelsemium can delete its dropper component from the targeted system.(Citation: ESET Gelsemium June 2021)
jRAT	jRAT has a function to delete files from the victim’s machine.(Citation: jRAT Symantec Aug 2018)
Komplex	The Komplex trojan supports file deletion.(Citation: Sofacy Komplex Trojan)
Denis	Denis has a command to delete files from the victim’s machine.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
MacSpy	MacSpy deletes any temporary files it creates(Citation: alientvault macspy)
Dtrack	Dtrack can remove its persistence and delete itself.(Citation: Securelist Dtrack)
LoudMiner	LoudMiner deleted installation files after completion.(Citation: ESET LoudMiner June 2019)
Azorult	Azorult can delete files from victim machines.(Citation: Unit42 Azorult Nov 2018)
ADVSTORESHELL	ADVSTORESHELL can delete files and directories.(Citation: ESET Sednit Part 2)
StrifeWater	StrifeWater can self delete to cover its tracks.(Citation: Cybereason StrifeWater Feb 2022)
SLOTHFULMEDIA	SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
FALLCHILL	FALLCHILL can delete malware and associated artifacts from the victim.(Citation: US-CERT FALLCHILL Nov 2017)
APT28	APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.(Citation: DOJ GRU Indictment Jul 2018)
Tropic Trooper	Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)
Evilnum	Evilnum has deleted files used during infection.(Citation: ESET EvilNum July 2020)
The White Company	The White Company has the ability to delete its malware entirely from the target system.(Citation: Cylance Shaheen Nov 2018)
Operation Wocao	Operation Wocao has deleted logs and executable files used during an intrusion.(Citation: FoxIT Wocao December 2019)
Lazarus Group	Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)
Gamaredon Group	Gamaredon Group tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)
APT29	APT29 has used SDelete to remove artifacts from victim networks.(Citation: Mandiant No Easy Breach)
APT39	APT39 has used malware to delete files after they are deployed on a compromised host.(Citation: FBI FLASH APT39 September 2020)
APT38	APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)
Dragonfly 2.0	Dragonfly 2.0 deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
Rocke	Rocke has deleted files on infected machines.(Citation: Anomali Rocke March 2019)
Aquatic Panda	Aquatic Panda has deleted malicious executables from compromised machines.(Citation: CrowdStrike AQUATIC PANDA December 2021)(Citation: Crowdstrike HuntReport 2022)
BRONZE BUTLER	The BRONZE BUTLER uploader or malware the uploader uses `command` to delete the RAR archives after they have been exfiltrated.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Honeybee	Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.(Citation: McAfee Honeybee)
BlackByte	BlackByte deleted ransomware executables post-encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
Silence	Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)
Wizard Spider	Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.(Citation: CrowdStrike Grim Spider May 2019)
Threat Group-3390	Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)
APT32	APT32's macOS backdoor can receive a “delete” command.(Citation: ESET OceanLotus macOS April 2019)
Group5	Malware used by Group5 is capable of remotely deleting files from victims.(Citation: Citizen Lab Group5)
Metador	Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware.(Citation: SentinelLabs Metador Sept 2022)
Dragonfly	Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.(Citation: US-CERT TA18-074A)
INC Ransom	INC Ransom has uninstalled tools from compromised endpoints after use.(Citation: Huntress INC Ransomware May 2024)
OilRig	OilRig has deleted files associated with their payload after execution.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 OopsIE! Feb 2018)
TEMP.Veles	TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.(Citation: FireEye TRITON 2019)
Chimera	Chimera has performed file deletion to evade detection.(Citation: Cycraft Chimera April 2020)
Volt Typhoon	Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Kimsuky	Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)
Sandworm Team	Sandworm Team has used backdoors that can delete files used in an attack from an infected system.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)(Citation: Mandiant-Sandworm-Ukraine-2022)
APT18	APT18 actors deleted tools and batch files from victim systems.(Citation: Dell Lateral Movement)
Magic Hound	Magic Hound has deleted and overwrote files to cover tracks.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)(Citation: DFIR Phosphorus November 2021)
menuPass	A menuPass macro deletes files after it has decoded and decompressed them.(Citation: Accenture Hogfish April 2018)(Citation: District Court of NY APT10 Indictment December 2018)
TeamTNT	TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)
APT5	APT5 has deleted scripts and web shells to evade detection.(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)
Patchwork	Patchwork removed certain files and replaced them so they could not be retrieved.(Citation: TrendMicro Patchwork Dec 2017)
Mustang Panda	Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.(Citation: Secureworks BRONZE PRESIDENT December 2019)
Ember Bear	Ember Bear deletes files related to lateral movement to avoid detection.(Citation: Cadet Blizzard emerges as novel threat actor)
RedCurl	RedCurl has deleted files after execution.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)(Citation: trendmicro_redcurl)
Play	Play has used tools including Wevtutil to remove malicious files from compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
FIN10	FIN10 has used batch scripts and scheduled tasks to delete critical system files.(Citation: FireEye FIN10 June 2017)
APT3	APT3 has a tool that can delete files.(Citation: FireEye Clandestine Fox)
FIN6	FIN6 has removed files from victim machines.(Citation: FireEye FIN6 April 2016)
Cobalt Group	Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.(Citation: Talos Cobalt Group July 2018)
APT41	APT41 deleted files from the system.(Citation: FireEye APT41 Aug 2019)(Citation: Rostovcev APT41 2021)
UNC2452	UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.(Citation: FireEye SUNBURST Backdoor December 2020)
FIN8	FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Symantec FIN8 Jul 2023)
FIN5	FIN5 uses SDelete to clean up the environment and attempt to prevent detection.(Citation: Mandiant FIN5 GrrCON Oct 2016)

Контрмера	Описание
Контрмеры
File Deletion Mitigation	Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to delete files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.

Indicator Removal: Удаление файлов

Other sub-techniques of Indicator Removal (10)

Примеры процедур

Контрмеры

Обнаружение

Ссылки