Potential Secure File Deletion via SDelete Utility

 1[metadata]
 2creation_date = "2020/08/18"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/03/28"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple
13file overwrite and rename operations.
14"""
15from = "now-9m"
16index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Potential Secure File Deletion via SDelete Utility"
20note = """## Triage and analysis
21
22### Investigating Potential Secure File Deletion via SDelete Utility
23
24SDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.
25
26This rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.
27
28#### Possible investigation steps
29
30- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
31- Investigate other alerts associated with the user/host during the past 48 hours.
32- Identify the user account that performed the action and whether it should perform this kind of action.
33- Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.
34
35### False positive analysis
36
37- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
38
39### Response and remediation
40
41- Initiate the incident response process based on the outcome of the triage.
42  - Prioritize cases involving critical servers and users.
43- Isolate the involved hosts to prevent further post-compromise behavior.
44- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
45- If important data was encrypted, deleted, or modified, activate your data recovery plan.
46    - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
47- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
48- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
49- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
50- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
51"""
52risk_score = 21
53rule_id = "5aee924b-6ceb-4633-980e-1bde8cdb40c5"
54severity = "low"
55tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Impact", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend", "Data Source: Sysmon"]
56timestamp_override = "event.ingested"
57type = "eql"
58
59query = '''
60file where host.os.type == "windows" and event.type == "change" and file.name : "*AAA.AAA"
61'''
62
63
64[[rule.threat]]
65framework = "MITRE ATT&CK"
66[[rule.threat.technique]]
67id = "T1070"
68name = "Indicator Removal"
69reference = "https://attack.mitre.org/techniques/T1070/"
70[[rule.threat.technique.subtechnique]]
71id = "T1070.004"
72name = "File Deletion"
73reference = "https://attack.mitre.org/techniques/T1070/004/"
74
75
76
77[rule.threat.tactic]
78id = "TA0005"
79name = "Defense Evasion"
80reference = "https://attack.mitre.org/tactics/TA0005/"
81
82
83[[rule.threat]]
84framework = "MITRE ATT&CK"
85[[rule.threat.technique]]
86id = "T1485"
87name = "Data Destruction"
88reference = "https://attack.mitre.org/techniques/T1485/"
89
90
91[rule.threat.tactic]
92id = "TA0040"
93name = "Impact"
94reference = "https://attack.mitre.org/tactics/TA0040/"