Executable artefact deleted from a staging directory

Siemphony@siemphonylowT1070.004unverified

AN0392 asks for deletion of dropped payloads and evidence files, so the rule pairs the two things Sysmon's FileDelete event actually carries: the path the deleted file sat in and its extension. The path list is MITRE's `FilePathPattern` knob, populated here with the world-writable and per-user staging directories a payload is normally dropped into, and the extension list restricts matches to executable and script content, because deletion of documents and data from those same directories is constant and carries no signal. A second, separate selection matches the secure-deletion utility named in MITRE's own technique description by `Image` alone, with no path or extension gate, because that tool renames a file repeatedly before unlinking it and the recorded `TargetFilename` is therefore not the name the payload was dropped under. Limits: Sysmon is not present in a default install, and FileDelete (EventID 23/26) is off or heavily path-restricted in most published configurations, so this rule returns nothing until those directories are in scope — zero rows means blind, not quiet. The rule is written in the Sysmon FileDelete vocabulary the brief names, `TargetFilename` and `Image`; the brief's Security 4663 leg is mapped onto the Sysmon-shaped `file_event` category but splits the same data across `ObjectName` and `ProcessName`, so it needs a field mapping and a SACL on each directory before it could carry this logic at all, and cannot simply be substituted. A payload deleted from a directory outside the list, or one that never had an executable extension, is not seen. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0140, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (((FolderPath contains "\\AppData\\Local\\Temp\\" or FolderPath contains "\\AppData\\Roaming\\" or FolderPath contains "\\Windows\\Temp\\" or FolderPath contains "\\Users\\Public\\" or FolderPath contains "\\ProgramData\\" or FolderPath contains "\\PerfLogs\\") and (FolderPath endswith ".exe" or FolderPath endswith ".dll" or FolderPath endswith ".ps1" or FolderPath endswith ".bat" or FolderPath endswith ".cmd" or FolderPath endswith ".vbs" or FolderPath endswith ".js" or FolderPath endswith ".hta" or FolderPath endswith ".scr")) or (InitiatingProcessFolderPath endswith "\\sdelete.exe" or InitiatingProcessFolderPath endswith "\\sdelete64.exe"))

Splunk · SPL

Run this as a search.

index=* (((TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\AppData\\Roaming\\*" OR TargetFilename="*\\Windows\\Temp\\*" OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\PerfLogs\\*") AND (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.ps1" OR TargetFilename="*.bat" OR TargetFilename="*.cmd" OR TargetFilename="*.vbs" OR TargetFilename="*.js" OR TargetFilename="*.hta" OR TargetFilename="*.scr")) OR (Image="*\\sdelete.exe" OR Image="*\\sdelete64.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\perflogs\\\\*") AND (TO_LOWER(file.path) LIKE "*.exe" OR TO_LOWER(file.path) LIKE "*.dll" OR TO_LOWER(file.path) LIKE "*.ps1" OR TO_LOWER(file.path) LIKE "*.bat" OR TO_LOWER(file.path) LIKE "*.cmd" OR TO_LOWER(file.path) LIKE "*.vbs" OR TO_LOWER(file.path) LIKE "*.js" OR TO_LOWER(file.path) LIKE "*.hta" OR TO_LOWER(file.path) LIKE "*.scr")) OR (TO_LOWER(process.executable) LIKE "*\\\\sdelete.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sdelete64.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_delete,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\Windows\\Temp\\|\\Users\\Public\\|\\ProgramData\\|\\PerfLogs\\)</field>    <field name="TargetFilename" type="pcre2">(?i)(\.exe$|\.dll$|\.ps1$|\.bat$|\.cmd$|\.vbs$|\.js$|\.hta$|\.scr$)</field>    <description>Executable artefact deleted from a staging directory (1/2)</description>    <mitre>      <id>T1070.004</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\sdelete\.exe$|\\sdelete64\.exe$)</field>    <description>Executable artefact deleted from a staging directory (2/2)</description>    <mitre>      <id>T1070.004</id>    </mitre>  </rule></group>

At a glance

Logsource: file_delete / windows
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: cc035609-0f00-4c25-a4c8-ede32a595732

ATT&CKT1070.004

T1070.004File Deletion

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

Deletion of executable artefacts out of the directories a payload is normally dropped into, plus any deletion performed by SDelete. AN0392 asks for deletion of dropped payloads and evidence files by native or external utilities, and names SDelete in its own text. The rule pairs the only two things Sysmon's FileDelete event reliably carries — where the file sat and what it was called — and adds a separate arm for the tool itself.

02 · Telemetry you need

Sysmon FileDelete: logsource category: file_delete, product: windows, verbatim from AN0392's first log source. Sysmon is not in a default install, and FileDelete (EventID 23/26) is off or heavily path-restricted in most published configurations. If your config does not cover %TEMP%, ProgramData and the rest of the list below, the rule returns nothing because it is blind, not because the fleet is clean — confirm those paths are in scope before you read silence as good news. The brief's Security 4663 leg is mapped onto the Sysmon-shaped file_event category but splits the same data across ObjectName and ProcessName; it needs a field mapping and a SACL on every directory, so it cannot simply be substituted.

03 · How the logic works

Three selections. selection_path is TargetFilename|contains over six staging directories: \AppData\Local\Temp\, \AppData\Roaming\, \Windows\Temp\, \Users\Public\, \ProgramData\, \PerfLogs\. selection_ext is TargetFilename|endswith over nine executable and script extensions, from .exe through .hta and .scr, because deletion of documents and data from those same folders is constant and carries no signal. selection_tool matches Image|endswith on \sdelete.exe and \sdelete64.exe. The condition is (selection_path and selection_ext) or selection_tool. Both SDelete names are listed on purpose: the 32-bit binary self-extracts and launches the 64-bit one, so an endswith on the wrapper alone would never fire. The tool arm carries no path or extension gate because SDelete renames a file repeatedly before unlinking it, so the recorded TargetFilename is not the name the payload was dropped under.

04 · Common false positives

The path-and-extension arm is the volume. Installers, updaters and bootstrappers — MSI custom actions, Chrome, Edge, Office and Teams updaters, Squirrel and Electron packages — unpack executables into %TEMP% or ProgramData and delete them once the install finishes. On any managed fleet that is the dominant match by a wide margin, and it is what sets level: low. Behind it: runtime-generated assemblies from Add-Type and XmlSerializers, agents writing a helper DLL for the lifetime of one process, and disk-hygiene tooling — Storage Sense, cleanmgr, Intune remediations — sweeping temp on a schedule. The tool arm is quiet by comparison; its one genuine benign source is an administrator sanitising free space on a host before it is re-issued.

05 · Detection maturity

tier_1: Lowest tier, and it sits there until it has been run against real data. Nothing here has been measured: not the hit volume your installer estate produces, not whether your Sysmon config emits EventID 23 for these paths at all, not whether the extension list matches what actually gets dropped. Run it as a hunt for a week, count what comes back, and let that decide the level.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The path list is MITRE's FilePathPattern knob, populated here with directories this pipeline chose — MITRE names the knob and supplies none of the values. TimeWindow and UserContext, its other two knobs on AN0392, are correlation shaped and cannot live in a single Sigma selection; those are a platform job. Practical first moves: exclude your updaters by their vendor subdirectory rather than dropping %TEMP% wholesale, and split selection_tool into its own rule at a higher level, since a secure-deletion utility running at all deserves waking someone and here it lands in the same bucket as updater churn. One gap to keep in view: the extension list is name-based, so a dropper writing payload.tmp or no extension clears it. Sysmon's header-derived IsExecutable would recover that, but it is not asserted here because its population depends on config, and .ps1/.bat/.vbs are script text and not executable, so both gates would be needed.

Declared by the author

Installers, updaters and bootstrappers — MSI custom actions, Chrome, Edge, Office and Teams updaters, Squirrel and Electron packages — which unpack executables and DLLs into %TEMP% or ProgramData and delete them once the install completes. This is by a wide margin the highest-volume match the rule produces on any managed fleet, and it is what sets the level.
Runtime-generated assemblies and scripts: .NET XmlSerializers and Add-Type output, ClickOnce, installer self-extractors and antivirus or telemetry agents writing a helper DLL into the user temp directory for the lifetime of one process and removing it on exit.
Disk-hygiene tooling — Storage Sense, cleanmgr, Configuration Manager and Intune remediation scripts, and third-party temp cleaners — sweeping Windows\Temp and per-user temp folders on a schedule, which deletes whatever executable content happens to be stale there.
Administrators running SDelete deliberately, to sanitise free space on a decommissioned host or to satisfy a data-handling policy before a machine is re-issued; the tool arm has no path gate and matches every file such a run deletes.

Noise checknot tested

No baseline event covers this rule’s log type (file_delete / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.004, evaluated against their file_delete events.

Share this rule

/u/siemphony/cc035609-0f00-4c25-a4c8-ede32a595732

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Executable artefact deleted from a staging directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it