File Deletion Via Del or Erase Commands
Detects the execution of built-in Windows commands "del" or "erase" to delete files. Adversaries often delete files to remove traces of their intrusion activity, minimize their footprint, or clean up after malware execution. This rule specifically looks for `cmd.exe` executing these commands, potentially with flags like `-f` (force delete), `-s` (delete from subdirectories), or `-q` (quiet mode).
Sigma
