File Deleted Via Sysinternals SDelete

Title: File Deleted Via Sysinternals SDelete
Status: test
Description:Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
References:
  -https://github.com/OTRF/detection-hackathon-apt29/issues/9
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
modified:2023-02-15
Tags:

• -'attack.stealth'
• -'attack.t1070.004'

Logsource:

• product: windows
• category: file_delete

Detection:
  selection:
    TargetFilename|endswith:
      -'.AAA'
      -'.ZZZ'

  filter_wireshark:
    TargetFilename|endswith: '\Wireshark\radius\dictionary.alcatel-lucent.aaa'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Legitimate usage
Level: medium