Potential Secure Deletion with SDelete

SigmaHQ Detections@sigmaHQ

•updated Dec 14, 2024•0•40

This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.