RA4301: Remove File

Summary

ID	RA4301
Brief Description	Remove a specific file from a (remote) host or a system
Author	Alex@Cyberok
Creation Date	2023/03/22
References	https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Search-and-Destroy-Malicious-Files
Response Stage	Eradication
Response Actions Implementations	Deleting a file from Windows with Powershell Deleting a file from Windows via SOLDR

Description

Deleting a file removes it from the location where it is stored. If the storage location is your hard disk, the file is moved to the Recycle Bin. If the storage location is a disk, CD, or network location, the file is destroyed.

To take immediate action on known and suspected malicious files, you can search and destroy the files. After you identify the presence of a malicious file, you can immediately destroy the file from any or all endpoints on which the file exists.