Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions

Alerts on Windows security file access events for object names ending in .AAA or .ZZZ, consistent with secure deletion behavior.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2017-06-14
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion → Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1485Data Destruction

What it detects

This rule flags Windows security events where file objects end with extensions commonly associated with SDelete operations. An attacker could use secure deletion tools to hinder recovery and reduce forensic evidence on targeted systems. The detection relies on Windows file access auditing events (Event IDs 4656, 4663, and 4658) and matches object names by their filename suffixes ('.AAA' or '.ZZZ').

Reporting behind it

Related detections9 linkedT1070.004 — drag to rearrange

Malicious JADEPUFFER Ransom Database Table Manipulation

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

Suspicious Self-Deleting Batch Script Execution Consistent with Agonizing Serpens Wiper Cleanup

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

Malicious S3 Bucket Deletion During Bling Libra Extortion

Suspicious Zone.Identifier Mark-of-the-Web Removal (via process_creation)

Suspicious Self-Deletion of Dropper via Command Line

Suspicious Self-Deletion via Choice Timer and Del Command via Cmd (via process_creation)

Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions

Pivot detection · T1070.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-potential-secure-deletion-via-sdelete-file-extensions-aaa-and-zzz-39a80702

title: Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions
id: ceb8965b-c8cd-45ad-9d29-a57e4d0ffdda
status: test
description: This rule flags Windows security events where file objects end with extensions commonly associated with SDelete operations. An attacker could use secure deletion tools to hinder recovery and reduce forensic evidence on targeted systems. The detection relies on Windows file access auditing events (Event IDs 4656, 4663, and 4658) and matches object names by their filename suffixes ('.AAA' or '.ZZZ').
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-14
modified: 2024-12-13
tags:
  - attack.impact
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070.004
  - attack.t1027.005
  - attack.t1485
  - attack.t1553.002
  - attack.s0195
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
      - 4658
    ObjectName|endswith:
      - .AAA
      - .ZZZ
  condition: selection
falsepositives:
  - Legitimate usage of SDelete
  - Files that are interacted with that have these extensions legitimately
level: medium
license: DRL-1.1
related:
  - id: 39a80702-d7ca-4a83-b776-525b1f86a36d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL