Detectionmediumtest
File Deleted Via Sysinternals SDelete
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Sat May 02Updated Wed Feb 156ddab845-b1b8-49c2-bbf7-1a11967f64bcwindows
Log Source
WindowsFile Delete
ProductWindows← raw: windows
CategoryFile Delete← raw: file_delete
Detection Logic
Detection Logic2 selectors
detection:
selection:
TargetFilename|endswith:
- '.AAA'
- '.ZZZ'
filter_wireshark:
TargetFilename|endswith: '\Wireshark\radius\dictionary.alcatel-lucent.aaa'
condition: selection and not 1 of filter_*False Positives
Legitimate usage
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
6ddab845-b1b8-49c2-bbf7-1a11967f64bc
Status
test
Level
medium
Type
Detection
Created
Sat May 02
Modified
Wed Feb 15
Path
rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml
Raw Tags
attack.defense-evasionattack.t1070.004