Windows: Potential Secure Deletion via SDelete File Extensions .AAA and .ZZZ

Alerts on Windows security file access events for object names ending in .AAA or .ZZZ, consistent with secure deletion behavior.

FreeUnreviewedSigmamediumv1

windows-potential-secure-deletion-via-sdelete-file-extensions-aaa-and-zzz-39a80702

title: "Windows: Potential Secure Deletion via SDelete File Extensions .AAA and .ZZZ"
id: ceb8965b-c8cd-45ad-9d29-a57e4d0ffdda
status: test
description: This rule flags Windows Security events where an object name ending in .AAA or .ZZZ is accessed with handle/file activity corresponding to EventID 4656, 4663, or 4658. Attackers may use secure deletion tooling to remove traces by overwriting target data, and matching these extensions can indicate such activity. It relies on Windows Security telemetry that records handle and file access events (ObjectName and EventID) in the security log.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-14
modified: 2024-12-13
tags:
  - attack.impact
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070.004
  - attack.t1027.005
  - attack.t1485
  - attack.t1553.002
  - attack.s0195
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
      - 4658
    ObjectName|endswith:
      - .AAA
      - .ZZZ
  condition: selection
falsepositives:
  - Legitimate usage of SDelete
  - Files that are interacted with that have these extensions legitimately
level: medium
license: DRL-1.1
related:
  - id: 39a80702-d7ca-4a83-b776-525b1f86a36d
    type: derived

What it detects

This rule flags Windows Security events where an object name ending in .AAA or .ZZZ is accessed with handle/file activity corresponding to EventID 4656, 4663, or 4658. Attackers may use secure deletion tooling to remove traces by overwriting target data, and matching these extensions can indicate such activity. It relies on Windows Security telemetry that records handle and file access events (ObjectName and EventID) in the security log.

Known false positives

Legitimate usage of SDelete
Files that are interacted with that have these extensions legitimately

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.