The SIEM app is now a part of the Elastic Security solution.
Click
here to view the current documentation.
IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
File Deletion via Shrededit
Identifies file deletions using the shred command. Malware or other files
dropped or created on a system by an adversary may leave traces behind as to
what was done within a network and how. Adversaries may remove these files over
the course of an intrusion to keep their footprint low or remove them at the
end as part of the post-intrusion cleanup process.
Rule type: query
Rule indices:
- auditbeat-*
Severity: low
Risk score: 21
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time)
Maximum signals per execution: 100
Tags:
- Elastic
- Linux
Version: 1
Added (Elastic Stack release): 7.8.0
Rule queryedit
event.action:(executed or process_started) and process.name:shred and
process.args:("-u" or "--remove" or "-z" or "--zero")
Threat mappingedit
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: File Deletion
- ID: T1107
- Reference URL: https://attack.mitre.org/techniques/T1107/