{"id":"39a80702-d7ca-4a83-b776-525b1f86a36d","title":"Potential Secure Deletion with SDelete","description":"Detects files that have extensions commonly seen while SDelete is used to wipe files.","author":"Thomas Patzke","status":"test","level":"medium","date":"2017-06-14","modified":"2024-12-13","tags":["attack.impact","attack.stealth","attack.defense-impairment","attack.t1070.004","attack.t1027.005","attack.t1485","attack.t1553.002","attack.s0195"],"technique_ids":["T1027.005","T1070.004","T1485","T1553.002"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Legitimate usage of SDelete","Files that are interacted with that have these extensions legitimately"],"references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm","https://www.jpcert.or.jp/english/pub/sr/ir_research.html","https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete"],"source_path":"rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml","source_sha256":"42c1e07fd708bd542bdc45d2a20dfc15e544ebd506c34141334cec323e5222e8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Secure Deletion with SDelete\nid: 39a80702-d7ca-4a83-b776-525b1f86a36d\nstatus: test\ndescription: Detects files that have extensions commonly seen while SDelete is used to wipe files.\nreferences:\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm\n    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html\n    - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete\nauthor: Thomas Patzke\ndate: 2017-06-14\nmodified: 2024-12-13\ntags:\n    - attack.impact\n    - attack.stealth\n    - attack.defense-impairment\n    - attack.t1070.004\n    - attack.t1027.005\n    - attack.t1485\n    - attack.t1553.002\n    - attack.s0195\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID:\n            - 4656\n            - 4663\n            - 4658\n        ObjectName|endswith:\n            - '.AAA'\n            - '.ZZZ'\n    condition: selection\nfalsepositives:\n    - Legitimate usage of SDelete\n    - Files that are interacted with that have these extensions legitimately\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.005","id":"T1027.005","name":"Indicator Removal from Tools","page":"techniques/enterprise/T1027.005/"},{"key":"enterprise/T1070.004","id":"T1070.004","name":"File Deletion","page":"techniques/enterprise/T1070.004/"},{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","page":"techniques/enterprise/T1485/"},{"key":"enterprise/T1553.002","id":"T1553.002","name":"Code Signing","page":"techniques/enterprise/T1553.002/"}],"data_path":"data/detection-rules/39a80702-d7ca-4a83-b776-525b1f86a36d.json","kind":"sigma"}