Possible Secure Removal with SDelete (via security)

title: Possible Secure Removal with SDelete (via security)
id: dd34370d-f618-5c02-82d5-c4b6736cfa17
status: stable
description: This rule detects files that have extensions frequently seen while SDelete is leveraged to wipe files.
references:
    - https://attack.mitre.org/techniques/T1553/002/
    - https://attack.mitre.org/techniques/T1485/
    - https://attack.mitre.org/techniques/T1027/005/
    - https://attack.mitre.org/techniques/T1070/004/
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm
    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
    - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete
author: Huntrule Team
date: 2026-05-19
tags:
    - attack.impact
    - attack.stealth
    - attack.defense-impairment
    - attack.t1070.004
    - attack.t1027.005
    - attack.t1485
    - attack.t1553.002
    - attack.s0195
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4656
            - 4663
            - 4658
        ObjectName|endswith:
            - '.AAA'
            - '.ZZZ'
    condition: selection
falsepositives:
    - Unknown
level: medium