File Deletion

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•2

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity