Potential File Overwrite Via Sysinternals SDelete

Title: Potential File Overwrite Via Sysinternals SDelete
Status: test
Description:Detects the use of SDelete to erase a file not the free space
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
Author: frack113
Date: 2021-06-03
modified:2023-02-28
Tags:

• -'attack.impact'
• -'attack.t1485'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    OriginalFileName: 'sdelete.exe'
  filter:
    CommandLine|contains:
      -' -h'
      -' -c'
      -' -z'
      -' /\?'

  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high