القائمة
Adversaries may delete files left behind by the actions of their intrusion activity.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1070-004-file-deletionيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | T1070.004_file-deletion |
| description | Adversaries may delete files left behind by the actions of their intrusion activity. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1070.004","defense-evasion","esxi","linux","macos","windows","sub-technique"] |
| technique_id | T1070.004 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1070/004 |
| tech_stack | ["esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1070","T1070.001","T1070.002","T1070.003","T1070.005","T1070.006","T1070.007","T1070.008","T1070.009","T1070.010"] |
| prerequisites | ["T1070"] |
| severity_boost | {"T1070":"Chain with T1070 for deeper attack path","T1070.001":"Chain with T1070.001 for deeper attack path","T1070.002":"Chain with T1070.002 for deeper attack path"} |
Sub-technique of: T1070
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and rm on ESXi.
Platforms: ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Delete a single file from the temporary directory
Supported Platforms: linux, macos
rm -f #{file_to_delete}
Dependencies:
Recursively delete the temporary directory and all files contained within it
Supported Platforms: linux, macos
rm -rf
Dependencies:
Use the shred command to overwrite the temporary file and then delete it
Supported Platforms: linux
shred -u #{file_to_shred}
Dependencies:
Delete a single file from the temporary directory using cmd.exe. Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.
Supported Platforms: windows
del /f #{file_to_delete}
Dependencies:
Recursively delete a folder in the temporary directory using cmd.exe. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.
Supported Platforms: windows
rmdir /s /q #{folder_to_delete}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to File Deletion by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1070.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| File Deletion technique applicable | Low | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |