Renamed Sysinternals Sdelete Execution

calendar Aug 12, 2024 · attack.impact attack.t1485  ·
Share on: linkedin copy

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Sigma rule (View on GitHub)

 1title: Renamed Sysinternals Sdelete Execution
 2id: c1d867fe-8d95-4487-aab4-e53f2d339f90
 3status: test
 4description: Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)
 5references:
 6    - https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete
 7    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
 8author: Florian Roth (Nextron Systems)
 9date: 2022-09-06
10modified: 2023-02-03
11tags:
12    - attack.impact
13    - attack.t1485
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        OriginalFileName: 'sdelete.exe'
20    filter:
21        Image|endswith:
22            - '\sdelete.exe'
23            - '\sdelete64.exe'
24    condition: selection and not filter
25fields:
26    - ComputerName
27    - User
28    - CommandLine
29    - ParentCommandLine
30falsepositives:
31    - System administrator usage
32level: high

References

Related rules

to-top