Prefetch File Deleted

Title: Prefetch File Deleted
Status: test
Description:Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence
References:
  -Internal Research
  -https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/
Author: Cedric MAURUGEON
Date: 2021-09-29
modified:2024-01-25
Tags:

• -'attack.stealth'
• -'attack.t1070.004'

Logsource:

• product: windows
• category: file_delete

Detection:
  selection:
    TargetFilename|contains: ':\Windows\Prefetch\'
    TargetFilename|endswith: '.pf'
  filter_main_svchost:
    Image|endswith: ':\windows\system32\svchost.exe'
    User|contains:
      -'AUTHORI'
      -'AUTORI'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high