SigmaHQ/rules/windows/file_delete/sysmon_sysinternals_sdelete_file_deletion.yml

title: Sysinternals SDelete File Deletion
id: 6ddab845-b1b8-49c2-bbf7-1a11967f64bc
description: A General detection to trigger for the deletion of files by Sysinternals SDelete. It looks for the common name pattern used to rename files.
status: experimental
date: 2020/05/02
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
tags:
    - attack.defense_evasion
    - attack.t1070.004
references:
    - https://github.com/OTRF/detection-hackathon-apt29/issues/9
    - https://threathunterplaybook.com/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.html
logsource:
    product: windows
    category: file_delete
detection:
    selection:
        TargetFilename|endswith:
            - '.AAA'
            - '.ZZZ'
    condition: selection
falsepositives:
    - Legitime usage of SDelete
level: medium
16 rules from DH APT29 day 1 - contributing soon 2020-10-12 22:13:13 +00:00			`title: Sysinternals SDelete File Deletion`
			`id: 6ddab845-b1b8-49c2-bbf7-1a11967f64bc`
			`description: A General detection to trigger for the deletion of files by Sysinternals SDelete. It looks for the common name pattern used to rename files.`
			`status: experimental`
			`date: 2020/05/02`
			`author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)`
			`tags:`
			`- attack.defense_evasion`
			`- attack.t1070.004`
			`references:`
			`- https://github.com/OTRF/detection-hackathon-apt29/issues/9`
			`- https://threathunterplaybook.com/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.html`
			`logsource:`
			`product: windows`
Clean-up service: sysmon as it will be replaced by filling the category 2021-04-15 00:02:25 +00:00			`category: file_delete`
16 rules from DH APT29 day 1 - contributing soon 2020-10-12 22:13:13 +00:00			`detection:`
			`selection:`
			`TargetFilename\|endswith:`
			`- '.AAA'`
			`- '.ZZZ'`
			`condition: selection`
			`falsepositives:`
			`- Legitime usage of SDelete`
			`level: medium`