1200KM / tool
SDelete — Attack Tool
SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: SDelete
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- APT29 · G0016 · Pinned relationship source (relationship--63185895-4afb-4886-adcc-fbfac1a117d6)
- Sandworm Team · G0034 · Pinned relationship source (relationship--67ad06ba-8fcc-490e-95fd-7322a97136f1)
- FIN5 · G0053 · Pinned relationship source (relationship--c4e81078-28b4-4a68-a946-458f4d122e39)
- Cobalt Group · G0080 · Pinned relationship source (relationship--ae11039c-6711-4860-a1b6-c7a8e0bcbbfb)
- Silence · G0091 · Pinned relationship source (relationship--da331399-4c9f-4a16-92b1-97e635703c18)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.