Data Exfil - Anti-Forensic Archive Cleanup (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects the threat actor clearing the staging archives securely via sdelete or forcefully via del /f /q immediately post-exfiltration. This rule correlates process execution of 'cmd.exe' or 'sdelete.exe' with specific command-line arguments targeting archive files (zip, rar, 7z) and a preceding network connection to a remote IP, indicating potential data exfiltration followed by anti-forensic cleanup.