Windows Process Creation: Renamed Sysinternals Sdelete Execution

Alerts on Windows processes created with OriginalFileName sdelete.exe but executed via renamed sdelete binary paths.

FreeUnreviewedSigmahighv1

windows-process-creation-renamed-sysinternals-sdelete-execution-c1d867fe

title: "Windows Process Creation: Renamed Sysinternals Sdelete Execution"
id: 6fd68e52-8336-41cf-b8d6-df9d664f091d
status: test
description: This rule flags executions where the process has an OriginalFileName of sdelete.exe, but the running image path ends with sdelete.exe (or sdelete64 variants) rather than being invoked as the original binary name. Renaming legitimate tools is a common way to evade allowlists and detection rules, and it can also indicate intentional misuse of a disk-wiping utility. It relies on Windows process creation telemetry, specifically the OriginalFileName field and the executable image path.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-06
modified: 2026-06-29
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: sdelete.exe
  filter:
    Image|endswith:
      - \sdelete.exe
      - \sdelete64.exe
      - \sdelete64a.exe
  condition: selection and not filter
falsepositives:
  - System administrator usage
level: high
license: DRL-1.1
related:
  - id: c1d867fe-8d95-4487-aab4-e53f2d339f90
    type: derived

What it detects

This rule flags executions where the process has an OriginalFileName of sdelete.exe, but the running image path ends with sdelete.exe (or sdelete64 variants) rather than being invoked as the original binary name. Renaming legitimate tools is a common way to evade allowlists and detection rules, and it can also indicate intentional misuse of a disk-wiping utility. It relies on Windows process creation telemetry, specifically the OriginalFileName field and the executable image path.

Known false positives

System administrator usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.