Backup Files Deleted

Title: Backup Files Deleted
Status: test
Description:Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files
Author: frack113
Date: 2022-01-02
modified:2023-02-15
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• product: windows
• category: file_delete

Detection:
  selection:
    Image|endswith:
      -'\cmd.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\wt.exe'
      -'\rundll32.exe'
      -'\regsvr32.exe'

    TargetFilename|endswith:
      -'.VHD'
      -'.bac'
      -'.bak'
      -'.wbcat'
      -'.bkf'
      -'.set'
      -'.win'
      -'.dsk'

  condition:selection
Falsepositives:
  -Legitimate usage
Level: medium