Potential Secure File Deletion via SDelete Utility

  1[metadata]
  2creation_date = "2020/08/18"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2024/10/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple
 13file overwrite and rename operations.
 14"""
 15from = "now-9m"
 16index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Potential Secure File Deletion via SDelete Utility"
 20note = """## Triage and analysis
 21
 22### Investigating Potential Secure File Deletion via SDelete Utility
 23
 24SDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.
 25
 26This rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.
 27
 28#### Possible investigation steps
 29
 30- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 31- Investigate other alerts associated with the user/host during the past 48 hours.
 32- Identify the user account that performed the action and whether it should perform this kind of action.
 33- Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.
 34
 35### False positive analysis
 36
 37- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
 38
 39### Response and remediation
 40
 41- Initiate the incident response process based on the outcome of the triage.
 42  - Prioritize cases involving critical servers and users.
 43- Isolate the involved hosts to prevent further post-compromise behavior.
 44- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 45- If important data was encrypted, deleted, or modified, activate your data recovery plan.
 46    - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
 47- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 48- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 49- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 50- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 51"""
 52risk_score = 21
 53rule_id = "5aee924b-6ceb-4633-980e-1bde8cdb40c5"
 54severity = "low"
 55tags = [
 56    "Domain: Endpoint",
 57    "OS: Windows",
 58    "Use Case: Threat Detection",
 59    "Tactic: Defense Evasion",
 60    "Tactic: Impact",
 61    "Data Source: Elastic Endgame",
 62    "Resources: Investigation Guide",
 63    "Data Source: Elastic Defend",
 64    "Data Source: Sysmon",
 65    "Data Source: Microsoft Defender for Endpoint",
 66    "Data Source: SentinelOne",
 67]
 68timestamp_override = "event.ingested"
 69type = "eql"
 70
 71query = '''
 72file where host.os.type == "windows" and event.type == "change" and file.name : "*AAA.AAA"
 73'''
 74
 75
 76[[rule.threat]]
 77framework = "MITRE ATT&CK"
 78[[rule.threat.technique]]
 79id = "T1070"
 80name = "Indicator Removal"
 81reference = "https://attack.mitre.org/techniques/T1070/"
 82[[rule.threat.technique.subtechnique]]
 83id = "T1070.004"
 84name = "File Deletion"
 85reference = "https://attack.mitre.org/techniques/T1070/004/"
 86
 87
 88
 89[rule.threat.tactic]
 90id = "TA0005"
 91name = "Defense Evasion"
 92reference = "https://attack.mitre.org/tactics/TA0005/"
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1485"
 97name = "Data Destruction"
 98reference = "https://attack.mitre.org/techniques/T1485/"
 99
100
101[rule.threat.tactic]
102id = "TA0040"
103name = "Impact"
104reference = "https://attack.mitre.org/tactics/TA0040/"