Prefetch File Deletion
This rule detects the deletion of prefetch files, which are used by Windows to speed up application launch times. Adversaries may delete these files to remove forensic evidence of their activities, making it harder to determine what applications were executed on a compromised system. The rule specifically looks for files ending with '.pf' within the ':\Windows\Prefetch\' directory. A filter is applied to exclude deletions performed by 'svchost.exe' with 'AUTHORI' or 'AUTORI' in the user field, as these are often legitimate system activities.
Sigma
