Detects the use of SDelete to erase a file not the free space

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Identifies when a device or device configuration in azure is modified or deleted.

Detects renaming of file while deletion with SDelete tool.

Detects potential overwriting and deletion of a file using DD.

Detects overwriting (effectively wiping/deleting) of a file.

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Identifies when an EKS cluster is created or deleted.

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.