Renamed Sysinternals Sdelete Execution

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•0

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)