File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. There are tools available from the host operatin...
BY SOURCE
PROCEDURES (17)
Auto-extracted: 9 detections for general monitoring
Auto-extracted: 8 detections for process creation monitoring
Auto-extracted: 4 detections for event log
Auto-extracted: 4 detections for file monitoring
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for ransomware
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for ransomware