PowerShell Remove-Item or Alias for File Deletion in Script Block

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects the use of PowerShell's `Remove-Item` cmdlet or its aliases (`del`, `erase`, `rd`, `ri`, `rm`, `rmdir`) with the `-Path` parameter within a PowerShell script block. This activity is indicative of file or folder deletion, which can be used by adversaries for defense evasion or to remove traces of their activity.