mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
82 lines
2.3 KiB
YAML
82 lines
2.3 KiB
YAML
name: Sdelete Application Execution
|
|
id: fcc52b9a-4616-11ec-8454-acde48001122
|
|
version: 4
|
|
date: '2021-11-15'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: Anomaly
|
|
description: This analytic will detect the execution of sdelete.exe attempting to
|
|
delete potentially important files that may related to adversary or insider threats
|
|
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
|
|
to securely delete files on disk. This tool is commonly used to clear tracks and
|
|
artifact on the targeted host.
|
|
data_source:
|
|
- Windows Security 4688
|
|
search:
|
|
selection1:
|
|
process.cmd_line|contains:
|
|
- .xls
|
|
- .gz
|
|
- .tar
|
|
- .rar
|
|
- .zip
|
|
- .7z
|
|
- .bmp
|
|
- .gif
|
|
- .png
|
|
- .jpg
|
|
- .txt
|
|
- .log
|
|
- .key
|
|
- .pdf
|
|
- .rtf
|
|
- .ppt
|
|
- .xls
|
|
- .doc
|
|
- -nobanner
|
|
- /accepteula
|
|
- '-z '
|
|
- '-s '
|
|
- '-q '
|
|
- '-r '
|
|
- '-p '
|
|
- '-f '
|
|
- '-c '
|
|
process.file.name|contains: sdelete
|
|
condition: (selection1)
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on process that include the name of the process responsible for the changes from
|
|
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
|
|
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
|
|
endpoint product.
|
|
known_false_positives: False positives should be limited, filter as needed.
|
|
references:
|
|
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
|
|
tags:
|
|
analytic_story:
|
|
- Information Sabotage
|
|
- Insider Threat
|
|
asset_type: Endpoint
|
|
confidence: 70
|
|
impact: 60
|
|
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
|
|
to permanently delete files by $dest_user_id$.
|
|
mitre_attack_id:
|
|
- T1485
|
|
- T1070.004
|
|
- T1070
|
|
observable: []
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields: []
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
risk_score: 42
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
|
|
source: WinEventLog:Security
|