Windows Process Creation: Renamed Sysinternals Sdelete Execution
Alerts on Windows processes created with OriginalFileName sdelete.exe but executed via renamed sdelete binary paths.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-06
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions where the process has an OriginalFileName of sdelete.exe, but the running image path ends with sdelete.exe (or sdelete64 variants) rather than being invoked as the original binary name. Renaming legitimate tools is a common way to evade allowlists and detection rules, and it can also indicate intentional misuse of a disk-wiping utility. It relies on Windows process creation telemetry, specifically the OriginalFileName field and the executable image path.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/sdelete
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Renamed Sysinternals Sdelete Execution"
id: 6fd68e52-8336-41cf-b8d6-df9d664f091d
status: test
description: This rule flags executions where the process has an OriginalFileName of sdelete.exe, but the running image path ends with sdelete.exe (or sdelete64 variants) rather than being invoked as the original binary name. Renaming legitimate tools is a common way to evade allowlists and detection rules, and it can also indicate intentional misuse of a disk-wiping utility. It relies on Windows process creation telemetry, specifically the OriginalFileName field and the executable image path.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-06
modified: 2026-06-29
tags:
- attack.impact
- attack.t1485
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName: sdelete.exe
filter:
Image|endswith:
- \sdelete.exe
- \sdelete64.exe
- \sdelete64a.exe
condition: selection and not filter
falsepositives:
- System administrator usage
level: high
license: DRL-1.1
related:
- id: c1d867fe-8d95-4487-aab4-e53f2d339f90
type: derived