name: Sdelete Application Execution
id: fcc52b9a-4616-11ec-8454-acde48001122
version: 1
date: '2021-11-15'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic will detect the execution of sdelete.exe attempting to
  delete potentially important files that may related to adversary or insider threats
  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
  to securely delete files on disk. This tool is commonly used to clear tracks and
  artifact on the targeted host.
data_source:
- Windows Security 4688
search:
  selection1:
    process.cmd_line|contains:
    - .xls
    - .gz
    - .tar
    - .rar
    - .zip
    - .7z
    - .bmp
    - .gif
    - .png
    - .jpg
    - .txt
    - .log
    - .key
    - .pdf
    - .rtf
    - .ppt
    - .xls
    - .doc
    - -nobanner
    - /accepteula
    - '-z '
    - '-s '
    - '-q '
    - '-r '
    - '-p '
    - '-f '
    - '-c '
    process.file.name|contains: sdelete
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: False positives should be limited, filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
tags:
  analytic_story:
  - Information Sabotage
  - Insider Threat
  asset_type: Endpoint
  confidence: 70
  impact: 60
  message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
    to permanently delete files by $dest_user_id$.
  mitre_attack_id:
  - T1485
  - T1070.004
  - T1070
  observable: []
  product:
  - Splunk Behavioral Analytics
  required_fields: []
  kill_chain_phases:
  - Exploitation
  risk_score: 42
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
    source: WinEventLog:Security