Detection of Linux Data Destruction via rm Command

This brief details the detection of a high-impact data destruction technique targeting Linux environments. The activity involves the execution of the Unix shell command 'rm' with the '--no-preserve-root' argument, which bypasses built-in safety protections designed to prevent the recursive deletion of the root file system. This specific command usage is a known behavior of the Awfulshred malware, which aims to inflict severe damage, including full system data loss and total service disruption. Monitoring for this command-line execution is essential for defenders, as it often marks the final stage of an intrusion where an attacker attempts to cripple the target system's integrity and forensic viability.

Impact

Successful execution of this command leads to irreversible data loss and total system instability. Depending on the privileges of the executing process, this can result in the destruction of all files and directories on the local host. This technique is primarily observed in destructive cyber campaigns intended to disrupt critical infrastructure and corporate operations.

Recommendation

Detection engineering teams should implement monitoring for process-creation events to catch this specific command pattern immediately.

• Deploy the provided Sigma rule to your SIEM and tune to ensure visibility into the 'rm' command-line arguments.
• Ensure that EDR or Sysmon for Linux is configured to log full command-line arguments, as 'rm' activity is a high-fidelity indicator of malicious intent.
• Alert on any instances where the 'rm' binary is executed by administrative or root-level service accounts with the '--no-preserve-root' flag.