Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
12
7
1
1
Contributors
10
6
1
1
1
Categories
7
7
3
3
2
Platforms
18
1
1
1
Products / Services
5
3
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects files that have extensions commonly seen while SDelete is used to wipe files.
This rule detects the execution of commands that include the ' -accepteula' flag. This flag is commonly used by Sysinternals tools to automatically accept their End User License Agreement (EULA), allowing for non-interactive execution. The presence of this flag in a command line can indicate the use of Sysinternals utilities, which are legitimate administrative tools but are also frequently leveraged by adversaries for various post-exploitation activities.
The following analytic detects the execution of the sdelete.exe application, a Sysinternals tool often used by adversaries to securely delete files and remove forensic evidence from a targeted host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as sdelete.exe is not commonly used in regular operations and its presence may indicate an attempt to cover malicious activities. If confirmed malicious, this could lead to the loss of critical forensic data, hindering incident response and investigation efforts.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
KQL Query
Detects files that have extensions commonly seen while SDelete is used to wipe files.
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Listing Email Remediation Actions performed via Explorer in Defender for Office 365
'This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C drive.
A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.
This detection uses the ASIM imProcess parser, this will need to be deployed before use - https://docs.microsoft.com/azure/sentinel/normalization'
A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.
This detection uses the ASIM imProcess parser, this will need to be deployed before use - https://docs.microsoft.com/azure/sentinel/normalization'
'This query looks for the Sdelete process being run recursively after being deployed to a host via GPO. Attackers could use this technique to deploy Sdelete to multiple host and delete data on them.
This query uses the Advanced Security Information Model. Parsers will need to be deployed before use: https://docs.microsoft.com/azure/sentinel/normalization'
This query uses the Advanced Security Information Model. Parsers will need to be deployed before use: https://docs.microsoft.com/azure/sentinel/normalization'
List alerts flagging attempts to delete backup files.
This YARA rule detects the Linux AutoColor backdoor by identifying specific byte patterns related to its core functionalities. These functionalities include installing library implants, self-deletion mechanisms, executing local files, and network proxy communication. The rule specifically targets ELF (Executable and Linkable Format) files, indicating it's designed for Linux executables.
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files before deletion, specifically files ending with '.AAA' or '.ZZZ'.
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. This key is created when a Sysinternals tool is run for the first time and the End User License Agreement (EULA) is accepted.
Detects the execution of Sysinternals tools that have been installed via an AppX package. This method of deployment might be used by attackers to bypass detection mechanisms that rely on monitoring standard system paths for these tools.
Detects the execution of Sysinternals Sdelete when its executable file has been renamed from its original name (sdelete.exe or sdelete64.exe). This behavior is often indicative of an attempt to evade detection or obscure the use of a legitimate tool for malicious purposes, such as data destruction.
Detects the execution of Sysinternals SDelete to overwrite a specific file, rather than its intended use of wiping free space or entire volumes. This activity is indicative of an adversary attempting to destroy data to prevent recovery or forensic analysis.
Detects the execution of a Sysinternals Tool via the creation of the "EulaAccepted" registry key. Many Sysinternals tools create this key upon first execution to signify acceptance of the End User License Agreement (EULA). This can be an indicator of Sysinternals tools being used on a system, which are often leveraged by adversaries for various post-exploitation activities.
Detects the creation of the "accepteula" registry key by Sysinternals tools that have been renamed. This behavior is suspicious because legitimate Sysinternals tools typically create this key with their original executable names. Adversaries often rename tools to evade detection, and this rule specifically looks for instances where the EULA acceptance key is created by an executable whose name does not match the expected Sysinternals tool name.