# T1070.004 - Indicator Removal on Host: File Deletion

## Description from ATT&CK

> Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
> 
> There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include <code>del</code> on Windows, <code>rm</code> or <code>unlink</code> on Linux and macOS, and `rm` on ESXi.

[Source](https://attack.mitre.org/techniques/T1070/004)

## Atomic Tests

- [Atomic Test #1: Delete a single file - FreeBSD/Linux/macOS](#atomic-test-1-delete-a-single-file---freebsdlinuxmacos)
- [Atomic Test #2: Delete an entire folder - FreeBSD/Linux/macOS](#atomic-test-2-delete-an-entire-folder---freebsdlinuxmacos)
- [Atomic Test #3: Overwrite and delete a file with shred](#atomic-test-3-overwrite-and-delete-a-file-with-shred)
- [Atomic Test #4: Delete a single file - Windows cmd](#atomic-test-4-delete-a-single-file---windows-cmd)
- [Atomic Test #5: Delete an entire folder - Windows cmd](#atomic-test-5-delete-an-entire-folder---windows-cmd)
- [Atomic Test #6: Delete a single file - Windows PowerShell](#atomic-test-6-delete-a-single-file---windows-powershell)
- [Atomic Test #7: Delete an entire folder - Windows PowerShell](#atomic-test-7-delete-an-entire-folder---windows-powershell)
- [Atomic Test #8: Delete Filesystem - Linux](#atomic-test-8-delete-filesystem---linux)
- [Atomic Test #9: Delete Prefetch File](#atomic-test-9-delete-prefetch-file)
- [Atomic Test #10: Delete TeamViewer Log Files](#atomic-test-10-delete-teamviewer-log-files)
- [Atomic Test #11: Clears Recycle bin via rd](#atomic-test-11-clears-recycle-bin-via-rd)

### Atomic Test #1: Delete a single file - FreeBSD/Linux/macOS

Delete a single file from the temporary directory

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `562d737f-2fc6-4b09-8c2a-7f8ff0828480`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| parent_folder | Path of parent folder | path | /tmp/victim-files/|
| file_to_delete | Path of file to delete | path | /tmp/victim-files/T1070.004-test.txt|

#### Attack Commands: Run with `sh`!

```sh
rm -f #{file_to_delete}
```

#### Cleanup Commands

```sh
rm -rf #{parent_folder}
```

#### Dependencies: Run with `sh`!

##### Description: The file must exist in order to be deleted

###### Check Prereq Commands

```sh
test -e #{file_to_delete} && exit 0 || exit 1
```

###### Get Prereq Commands

```sh
mkdir -p #{parent_folder} && touch #{file_to_delete}
```

### Atomic Test #2: Delete an entire folder - FreeBSD/Linux/macOS

Recursively delete the temporary directory and all files contained within it

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `a415f17e-ce8d-4ce2-a8b4-83b674e7017e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| folder_to_delete | Path of folder to delete | path | /tmp/victim-folder|

#### Attack Commands: Run with `sh`!

```sh
rm -rf #{folder_to_delete}
```


#### Dependencies: Run with `sh`!

##### Description: The folder must exist in order to be deleted

###### Check Prereq Commands

```sh
test -e #{folder_to_delete} && exit 0 || exit 1
```

###### Get Prereq Commands

```sh
mkdir -p #{folder_to_delete}
```

### Atomic Test #3: Overwrite and delete a file with shred

Use the `shred` command to overwrite the temporary file and then delete it

**Supported Platforms:** Linux

**auto_generated_guid:** `039b4b10-2900-404b-b67f-4b6d49aa6499`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_to_shred | Path of file to shred | path | /tmp/victim-shred.txt|

#### Attack Commands: Run with `sh`!

```sh
shred -u #{file_to_shred}
```


#### Dependencies: Run with `sh`!

##### Description: Check if file already exists

###### Check Prereq Commands

```sh
if [ -f "#{file_to_shred}" ]; then echo "File already exists"; else echo "File does NOT exist yet"; exit 1; fi
```

###### Get Prereq Commands

```sh
touch #{file_to_shred}
```

### Atomic Test #4: Delete a single file - Windows cmd

Delete a single file from the temporary directory using cmd.exe.
Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.

**Supported Platforms:** Windows

**auto_generated_guid:** `861ea0b4-708a-4d17-848d-186c9c7f17e3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_to_delete | File to delete. Run the prereq command to create it if it does not exist. | string | %temp%&#92;deleteme_T1551.004|

#### Attack Commands: Run with `command_prompt`!

```cmd
del /f #{file_to_delete}
```


#### Dependencies: Run with `command_prompt`!

##### Description: The file to delete must exist on disk at specified location (#{file_to_delete})

###### Check Prereq Commands

```cmd
IF EXIST "#{file_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 )
```

###### Get Prereq Commands

```cmd
echo deleteme_T1551.004 >> #{file_to_delete}
```

### Atomic Test #5: Delete an entire folder - Windows cmd

Recursively delete a folder in the temporary directory using cmd.exe.
Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted.

**Supported Platforms:** Windows

**auto_generated_guid:** `ded937c4-2add-42f7-9c2c-c742b7a98698`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| folder_to_delete | Folder to delete. Run the prereq command to create it if it does not exist. | string | %temp%&#92;deleteme_T1551.004|

#### Attack Commands: Run with `command_prompt`!

```cmd
rmdir /s /q #{folder_to_delete}
```


#### Dependencies: Run with `command_prompt`!

##### Description: The file to delete must exist on disk at specified location (#{folder_to_delete})

###### Check Prereq Commands

```cmd
IF EXIST "#{folder_to_delete}" ( EXIT 0 ) ELSE ( EXIT 1 )
```

###### Get Prereq Commands

```cmd
mkdir #{folder_to_delete}
```

### Atomic Test #6: Delete a single file - Windows PowerShell

Delete a single file from the temporary directory using Powershell. Upon execution, no output will be displayed. Use File Explorer to verify the file was deleted.

**Supported Platforms:** Windows

**auto_generated_guid:** `9dee89bd-9a98-4c4f-9e2d-4256690b0e72`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|-------------