Detectionmediumtest

Backup Files Deleted

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Sun Jan 02Updated Wed Feb 1506125661-3814-4e03-bfa2-1e4411c60ac3windows

Log Source

WindowsFile Delete

ProductWindows← raw: windows

CategoryFile Delete← raw: file_delete

Detection Logic

detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wt.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
        TargetFilename|endswith:
            - '.VHD'
            - '.bac'
            - '.bak'
            - '.wbcat'
            - '.bkf'
            - '.set'
            - '.win'
            - '.dsk'
    condition: selection