Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1070.004_file-deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
Passed 21 of 21 test cases with the skill, and 12 of 21 without it.
and 9 more in the full report
9 fixed13 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
A virtualization security audit is reviewing ATT&CK indicator removal sub-techniques. Does MITRE ATT&CK T1070.004 list VMware ESXi among its supported operating system platforms alongside Linux, macOS, and Windows?
| Checked | Without skill | With skill |
|---|---|---|
| Confirms ESXi is listed as a target platform for T1070.004. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1070
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and rm on ESXi.
Platforms: ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Delete a single file from the temporary directory
Supported Platforms: linux, macos
rm -f #{file_to_delete}
test cases passed, vs 12 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.