Detect The Removal Of Evidence On Executed Programs

Query

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_all ("del", "C:\\Windows\\Prefetch", ".pf")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, ReportId

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1070.004	Indicator Removal: File Deletion

Author: Sergio Albea (02/07/2025)

Detect the removal of evidence on executed programs

A typical technique used by ransomware operators is the deletion of Prefetch files, which track recently executed programs. By running commands like del C:\Windows\Prefetch*.pf, attackers attempt to erase forensic traces of tools they’ve used.This behavior is aimed at hindering investigation and slowing down incident response.

Explanation

This query is designed to detect attempts to delete Prefetch files on a Windows system, which is a technique used by attackers to cover their tracks. Prefetch files help in tracking recently executed programs, and their deletion can hinder forensic investigations.

Here's a simple breakdown of what the query does:

Data Source: It looks at DeviceProcessEvents, which contains information about processes that have been executed on devices.
Time Frame: The query focuses on events that occurred in the last 7 days (Timestamp > ago(7d)).
Specific Action: It searches for command lines that include the terms "del", "C:\Windows\Prefetch", and ".pf". This indicates an attempt to delete Prefetch files.
Output: The query retrieves and displays specific details about these events, including:
- The time the event occurred (Timestamp).
- The name of the device where the event took place (DeviceName).
- The name of the process that initiated the deletion (InitiatingProcessFileName).
- The name of the file involved (FileName).
- The full command line used (ProcessCommandLine).
- The account name under which the process was run (AccountName).
- A report identifier for further reference (ReportId).

Overall, this query helps security teams identify and investigate potential malicious activity related to the deletion of Prefetch files, which could indicate an attempt to hide evidence of executed programs.

KQL Search