Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions

Alerts on Windows security file access events for object names ending in .AAA or .ZZZ, consistent with secure deletion behavior.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2017-06-14
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion → Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1485Data Destruction

What it detects

This rule flags Windows security events where file objects end with extensions commonly associated with SDelete operations. An attacker could use secure deletion tools to hinder recovery and reduce forensic evidence on targeted systems. The detection relies on Windows file access auditing events (Event IDs 4656, 4663, and 4658) and matches object names by their filename suffixes ('.AAA' or '.ZZZ').

Reporting behind it

Related detections9 linkedT1485 — drag to rearrange

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

Suspicious Free Space Wipe via cipher.exe

Suspicious sha256sum.exe Execution from Windows Temp Directory

Suspicious Secure Deletion of Free Space via Cipher (via process_creation)

HamsaUpdate Wiper Trigger via F5UPDATER ConfirmDeleteFiles Argument (via process_creation)

Suspicious Crontab Removal via Command Line (via process_creation)

Suspicious Self-Deletion via Ping Loopback and Del (via process_creation)

Malicious Scheduled Task Deploying DYNOWIPER Payload (via process_creation)

Malicious Self-Deletion Via Fsutil SetZeroData

Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions

Pivot detection · T1485 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-potential-secure-deletion-via-sdelete-file-extensions-aaa-and-zzz-39a80702

title: Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions
id: ceb8965b-c8cd-45ad-9d29-a57e4d0ffdda
status: test
description: This rule flags Windows security events where file objects end with extensions commonly associated with SDelete operations. An attacker could use secure deletion tools to hinder recovery and reduce forensic evidence on targeted systems. The detection relies on Windows file access auditing events (Event IDs 4656, 4663, and 4658) and matches object names by their filename suffixes ('.AAA' or '.ZZZ').
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-14
modified: 2024-12-13
tags:
  - attack.impact
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070.004
  - attack.t1027.005
  - attack.t1485
  - attack.t1553.002
  - attack.s0195
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
      - 4658
    ObjectName|endswith:
      - .AAA
      - .ZZZ
  condition: selection
falsepositives:
  - Legitimate usage of SDelete
  - Files that are interacted with that have these extensions legitimately
level: medium
license: DRL-1.1
related:
  - id: 39a80702-d7ca-4a83-b776-525b1f86a36d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL