Renamed Sysinternals Sdelete Execution
Detects the execution of Sysinternals Sdelete when its executable file has been renamed from its original name (sdelete.exe or sdelete64.exe). This behavior is often indicative of an attempt to evade detection or obscure the use of a legitimate tool for malicious purposes, such as data destruction.
Sigma
