用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1070-004-file-deletion命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1070.004_file-deletion |
| description | Adversaries may delete files left behind by the actions of their intrusion activity. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1070.004","defense-evasion","esxi","linux","macos","windows","sub-technique"] |
| technique_id | T1070.004 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1070/004 |
| tech_stack | ["esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1070","T1070.001","T1070.002","T1070.003","T1070.005","T1070.006","T1070.007","T1070.008","T1070.009","T1070.010"] |
| prerequisites | ["T1070"] |
| severity_boost | {"T1070":"Chain with T1070 for deeper attack path","T1070.001":"Chain with T1070.001 for deeper attack path","T1070.002":"Chain with T1070.002 for deeper attack path"} |
Sub-technique of: T1070
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and rm on ESXi.
Platforms: ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Delete a single file from the temporary directory
Supported Platforms: linux, macos
rm -f #{file_to_delete}
Dependencies:
Recursively delete the temporary directory and all files contained within it
Supported Platforms: linux, macos
rm -rf
Dependencies:
Use the shred command to overwrite the temporary file and then delete it
Supported Platforms: linux
shred -u #{file_to_shred}
Dependencies:
Delete a single file from the temporary directory using cmd.exe. Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.
Supported Platforms: windows
del /f #{file_to_delete}
Dependencies:
Recursively delete a folder in the temporary directory using cmd.exe. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.
Supported Platforms: windows
rmdir /s /q #{folder_to_delete}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to File Deletion by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1070.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| File Deletion technique applicable | Low | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |