File Deleted Via Sysinternals SDelete

SigmaHQ Detections@sigmaHQ

•updated Feb 28, 2025•0•23

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files before deletion, specifically files ending with '.AAA' or '.ZZZ'.