Windows File Deletion Using Sysinternals SDelete (.AAA/.ZZZ) Filename Suffixes

title: Windows File Deletion Using Sysinternals SDelete (.AAA/.ZZZ) Filename Suffixes
id: aaec83e8-6ef1-468b-b4c2-01b8ae26d7a2
status: test
description: This rule flags file deletion activity where the target filename ends with .AAA or .ZZZ, matching common renaming patterns associated with Sysinternals SDelete usage. Attackers may use file deletion utilities to remove artifacts and reduce forensic evidence. The detection relies on Windows file deletion telemetry containing the TargetFilename value and uses suffix-based matching to identify the patterned filenames.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/9
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2023-02-15
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    TargetFilename|endswith:
      - .AAA
      - .ZZZ
  filter_wireshark:
    TargetFilename|endswith: \Wireshark\radius\dictionary.alcatel-lucent.aaa
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate usage
level: medium
license: DRL-1.1
related:
  - id: 6ddab845-b1b8-49c2-bbf7-1a11967f64bc
    type: derived