File Deletion — Detection Rule

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Read the full analysis on IntelFusions