auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b5b0e8ae-7436-4951-950a-7b83c4dd3f2c
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0076
external_id: DC0076
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Instance Creation
description: The initial provisioning and construction of a virtual machine (VM) or compute instance within a cloud infrastructure environment. This activity involves defining and allocating resources such as CPU, memory, storage, and networking to spin up a new compute instance. Examples:

- AWS: creating an EC2 instance using RunInstances API calls.
- Azure, creating a VM through the Azure Resource Manager (ARM).
- GCP, an `instance.insert` action recorded.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: azure:activity
channel: Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown
name: gcp:audit
channel: compute.instances.insert: sourceImage not in approved projects OR has external image link
name: azure:activity
channel: MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE
name: gcp:audit
channel: compute.instances.insert
name: AWS:CloudTrail
channel: RunInstances,CreateImage
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b5d0492b-cda4-421c-8e51-ed2b8d85c5d0
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0013
external_id: DC0013
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:38.578Z
name: User Account Metadata
description: Contextual data about an account, which may include a username, user ID, environmental data, etc.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: EventCode=4720, 4738
name: WinEventLog:Security
channel: EventCode=4673
name: AWS:CloudTrail
channel: AssumeRole
name: auditd:SYSCALL
channel: open,openat,read
name: macos:MDM
channel: profiles -P|getaccountpolicies
name: AWS:CloudTrail
channel: GetAccountPasswordPolicy
name: azure:audit
channel: operation contains 'Get*Password*Policy' OR 'List*Authentication*Policy' OR 'Get-ADDefaultDomainPasswordPolicy'
name: m365:unified
channel: Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))
name: saas:auth
channel: Refresh token issuance or refresh token usage from new IPs or user agents
name: gcp:audit
channel: Directory API Access: users.list or groups.list
name: CloudTrail:GetCallerIdentity
channel: GetCallerIdentity
name: vpxd.log
channel: vCenter Management
name: macos:unifiedlog
channel: Creation of user account with UID <500
name: WinEventLog:Security
channel: EventCode=4674
name: windows:osquery
channel: User enumeration with creation/last modified timestamps
name: linux:osquery
channel: Listing of /etc/passwd and /etc/shadow metadata
name: saas:okta
channel: User lifecycle events
name: Microsoft Entra ID Audit Logs
channel: RoleManagement.Read.Directory or Directory.Read.All
name: azure:activity
channel: Azure CLI Operation: Microsoft.Graph/users/read
name: gcp:audit
channel: IAM API call: serviceAccounts.list or projects.getIamPolicy
name: Microsoft Graph API Logs
channel: users.list, directoryObjects.getByIds
name: Defender for Identity
channel: Suspicious Enumeration of Cloud Directory
name: Google Admin Audit
channel: users.list, groups.list
name: AWS:CloudTrail
channel: PassRole
name: gcp:iam
channel: PrincipalEmail with serviceAccountTokenCreator impersonating new identity
name: AWS:CloudTrail
channel: AssumeRole: Discovery actions tied to assumed identities outside of normal context
name: saas:okta
channel: User Enumeration Events
name: gcp:audit
channel: Directory API Access
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b9a1578e-8653-4103-be23-cb52e0b1816e
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0048
external_id: DC0048
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:39.039Z
name: Named Pipe Metadata
description: Contextual data about a named pipe on a system, including pipe name and creating process (ex: Sysmon EIDs 17-18)

*Data Collection Measures:*

- Windows:
 - Sysmon Event ID 17: Logs the creation of a named pipe.
 - Sysmon Event ID 18: Logs connection attempts to a named pipe.
 - Windows Security Event ID 5145: Logs access attempts to named pipes via SMB shares.
 - ETW (Event Tracing for Windows): Provides deep telemetry into named pipe interactions.
- Linux/macOS:
 - AuditD (`mkfifo`, `open`, `read`, `write` syscalls): Tracks FIFO (named pipe) creation and usage.
 - Lsof (`lsof -p ` or `lsof | grep PIPE`): Lists active named pipes and associated processes.
 - Strace (`strace -e open `): Monitors named pipe interactions.
- Endpoint Detection & Response (EDR):
 - Capture named pipe events as part of process tracking.
- Memory Forensics:
 - Volatility Plugin (`pipescan`): Enumerates named pipes in system memory.
 - Rekall Framework: Identifies active named pipes and associated processes.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Sysmon
channel: EventCode=17
name: macos:unifiedlog
channel: XPC messages requesting privileged actions from untrusted or unsigned clients
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--bf91faa8-0049-4870-810a-4df55e0b77ee
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0044
external_id: DC0044
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Firewall Enumeration
description: Querying and extracting a list of available firewalls or their associated configurations and rules. This activity can occur across host systems and cloud control planes, providing insight into the state and configuration of firewalls that protect the environment. Examples: 

- Querying Host-Based Firewalls: Using Windows PowerShell commands like `Get-NetFirewallRule` or Linux commands such as `iptables -L` or `firewalld --list-all`.
- Cloud Firewall Rule Listing: Running commands like `az network firewall list` for Azure or `aws ec2 describe-security-groups` for AWS.
- Using Management APIs: Leveraging APIs like Google Cloud Firewall's `list` API method or AWS's DescribeSecurityGroups API.
Identifying Misconfigurations: Extracting firewall rules to identify “allow all” policies or rules that lack logging.
- Enumerating with CLI Tools: Using CLI commands like `gcloud compute firewall-rules list` to extract firewall settings in Google Cloud.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--c0edd522-0aef-46b3-8efa-2bd334ce4242
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0121
external_id: DC0121
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Pod Metadata
description: Contextual data about a pod and activity around it such as name, ID, namespace, or status
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--cc150ad8-ecfa-4340-9aaa-d21165873bd4
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0096
external_id: DC0096
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Passive DNS
description: "Domain Name: Passive DNS" captures logged historical and real-time domain name system (DNS) data. This includes records of domain-to-IP address resolutions over time, enabling analysts to track the evolution of domain infrastructure, uncover historical patterns of use, and detect malicious activities tied to domains and their associated IP addresses. Examples: 

- Historical Resolutions
- Shared IP Usage
- Temporal Patterns
- Malicious Domain Clustering
- Historical Lookback

This data component can be collected through the following measures:

- Passive DNS Platforms: Use platforms that specialize in passive DNS collection and analysis:
 - Tools: Farsight DNSDB, RiskIQ PassiveTotal, PassiveDNS.
- Threat Intelligence Feeds: Integrate passive DNS data from commercial or open-source threat intelligence providers.
- Custom DNS Collectors: Deploy custom tools to capture DNS traffic at the network level for analysis.
- Cloud DNS Services: Leverage cloud DNS services (e.g., AWS Route 53, Azure DNS) that maintain DNS query logs.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Domain Name
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--d46272ce-a0fe-4256-855e-738de7bb63ee
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0092
external_id: DC0092
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:39.109Z
name: Volume Modification
description: Changes made to a cloud volume, including its settings and control data (ex: AWS modify-volume)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: kubernetes:apiserver
channel: Pod spec with hostPath or privileged securityContext
name: AWS:CloudTrail
channel: ModifyVolume
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--d5fca4e4-e47a-487b-873f-3d22f8865e96
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0020
external_id: DC0020
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Process Modification
description: Changes made to a running process, such as writing data into memory, modifying execution behavior, or injecting code into an existing process. Adversaries frequently modify processes to execute malicious payloads, evade detection, or gain escalated privileges.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: auditd:SYSCALL
channel: rename, chmod
name: auditd:SYSCALL
channel: mprotect
name: macos:endpointsecurity
channel: ES_EVENT_MMAP
name: auditd:SYSCALL
channel: kill syscalls targeting auditd process
name: macos:unifiedlog
channel: memory mapping
name: WinEventLog:Sysmon
channel: EventCode=8
name: macos:osquery
channel: Memory Mappings
name: ebpf:tracepoints
channel: Runtime memory overwrite of argv[] memory region
name: etw:Microsoft-Windows-Kernel-Process
channel: Memory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process
name: macos:unifiedlog
channel: Anomalous dyld dynamic library loads or RWX memory mappings in browser process
name: auditd:SYSCALL
channel: open, rename
name: auditd:SYSCALL
channel: SYSCALL ptrace/mprotect
name: macos:endpointsecurity
channel: ES_EVENT_TYPE_NOTIFY_MMAP
name: macos:unifiedlog
channel: process, library load, memory operations
name: auditd:SYSCALL
channel: rename
name: linux:osquery
channel: Detection of bitwise operations or custom encryption functions in memory traces
name: macos:unifiedlog
channel: Abnormal memory operations (XOR/bitwise loops) during archive generation
name: auditd:memprotect
channel: change from PROT_READ|PROT_WRITE to PROT_EXEC
name: linux:procfs
channel: /proc/[pid]/maps, /proc/[pid]/mem
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--d6257b8e-869c-41c0-8731-fdca40858a91
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0009
external_id: DC0009
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: User Account Deletion
description: The removal of a user, service, or machine account from an operating system, cloud identity management system, or directory service.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: EventCode=4726, 4657
name: esxi:hostd
channel: method=RemoveUser or esxcli system account remove invocation
name: m365:unified
channel: Remove-Mailbox, Set-Mailbox
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0063
external_id: DC0063
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Windows Registry Key Modification
description: Changes made to an existing registry key or its values. These modifications can include altering permissions, modifying stored data, or updating configuration settings.

*Data Collection Measures:*

- Windows Event Logs
 - Event ID 4657 - Registry Value Modified: Logs changes to registry values, including modifications to startup entries, security settings, or system configurations.
- Sysmon (System Monitor) for Windows
 - Sysmon Event ID 13 - Registry Value Set: Captures changes to specific registry values.
 - Sysmon Event ID 14 - Registry Key & Value Renamed: Logs renaming of registry keys, which may indicate evasion attempts.
- Endpoint Detection and Response (EDR) Solutions
 - Monitor registry modifications for suspicious behavior.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Windows Registry
channel: None
name: WinEventLog:Security
channel: EventCode=4657
name: WinEventLog:Security
channel: EventCode=4663, 4670, 4656
name: WinEventLog:Sysmon
channel: StubPath value written under HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
name: m365:unified
channel: MacroSecuritySettingsChanged or SafeModeDisabled
name: WinEventLog:Sysmon
channel: EventCode=13, 14
name: WinEventLog:Security
channel: modification to Winlogon registry keys such as Shell, Notify, or Userinit
name: WinEventLog:Security
channel: Registry key modification HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast
name: macos:unifiedlog
channel: g_CiOptions modification or SIP state change
name: WinEventLog:Sysmon
channel: Autoruns reports DLLs in AppInit_DLLs key
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--dad75cc7-5bae-4175-adb4-ca1962d8650e
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0097
external_id: DC0097
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Volume Creation
description: The initial provisioning of block storage volumes in cloud or on-prem environments, typically used for data storage, backup, or workload scaling.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: CreateVolume
name: WinEventLog:Microsoft-Windows-VSS
channel: Volume Shadow Copy Creation
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--deb22295-7e37-4a3b-ac6f-c86666fbe63d
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0014
external_id: DC0014
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: User Account Creation
description: The initial establishment of a new user, service, or machine account within an operating system, cloud environment, or identity management system.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: EventCode=4720
name: azure:audit
channel: Add user
name: AWS:CloudTrail
channel: CreateUser
name: saas:zoom
channel: New user created
name: saas:slack
channel: admin.user.create
name: m365:unified
channel: Add user
name: auditd:SYSCALL
channel: adduser
name: docker:daemon
channel: ExecCreate + usermod or useradd
name: auditd:SYSCALL
channel: useradd or adduser executed
name: networkdevice:syslog
channel: username privilege 
name: saas:okta
channel: user.lifecycle.create
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--df508a43-65f5-453f-8b8f-4b5d64e60a21
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0122
external_id: DC0122
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Container Metadata
description: Contextual data about a container and activity around it such as name, ID, image, or status
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--e214eb6d-de8f-4154-9015-6d47915fbed1
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0027
external_id: DC0027
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Storage Metadata
description: Cloud Storage Metadata provides contextual information about cloud storage infrastructure and its associated activity. This data may include attributes such as storage name, size, owner, permissions, creation date, region, and activity metadata. It is essential for monitoring, auditing, and identifying anomalies in cloud storage environments. Examples: 

- AWS S3 Bucket Metadata: Metadata about an S3 bucket includes the bucket name, region, creation date, owner, storage class, and permissions.
- Azure Blob Storage Metadata: Metadata for an Azure Blob container includes container name, access level (e.g., private or public), size, and tags.
- Google Cloud Storage Metadata: Metadata includes bucket name, storage class, location, labels, lifecycle policies, and versioning status.
- OpenStack Swift Metadata: Metadata for a Swift container includes name, access level, quota, and custom attributes.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: Post-authentication metadata enumeration from GUI session
name: m365:unified
channel: AnonymousLinkCreated
name: saas:box
channel: collaboration.invite
name: saas:dropbox
channel: Shared link created to external account
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0040
external_id: DC0040
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: File Deletion
description: Refers to events where files are removed from a system or storage device. These events can indicate legitimate housekeeping activities or malicious actions such as attackers attempting to cover their tracks. Monitoring file deletions helps organizations identify unauthorized or suspicious activities.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: File
channel: None
name: auditd:SYSCALL
channel: unlink/unlinkat on service binaries or data targets
name: auditd:SYSCALL
channel: file deletion
name: macos:osquery
channel: file_events
name: esxi:shell
channel: shell history
name: WinEventLog:Sysmon
channel: EventCode=23
name: auditd:SYSCALL
channel: PATH
name: esxi:shell
channel: /var/log/shell.log
name: esxi:hostd
channel: delete action
name: auditd:SYSCALL
channel: unlink, unlinkat, openat, write
name: macos:unifiedlog
channel: exec rm -rf|dd if=/dev|srm|file unlink
name: auditd:SYSCALL
channel: unlink, unlinkat, rmdir
name: auditd:SYSCALL
channel: unlink, rename, open
name: linux:Sysmon
channel: EventCode=23
name: fs:fsusage
channel: unlink, fs_delete
name: docker:daemon
channel: container file operations
name: esxi:hostd
channel: rm, clearlogs, logrotate
name: esxi:hostd
channel: Datastore file operations
name: macos:osquery
channel: CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes
name: auditd:SYSCALL
channel: unlink/unlinkat
name: WinEventLog:Microsoft-Windows-Backup
channel: Windows Backup Catalog deletion or catalog corruption
name: auditd:CONFIG_CHANGE
channel: /etc/fstab, /etc/systemd/*