Backup Files Deleted by Command-Line Utilities
Detects the deletion of files commonly used for backups by adversaries to prevent system recovery. This rule specifically looks for deletion actions performed by common Windows command-line interpreters and system utilities on files with backup-related extensions.
Sigma
