Potential re-named sdelete usage

Status: available
Severity: low
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C drive. A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading
Impact	`T1485` Data Destruction

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: 720d12c6-a08c-44c4-b18f-2236412d59b0
name: Potential re-named sdelete usage
description: |
  'This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C drive.
  A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.'
severity: Low
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - DefenseEvasion
  - Impact
relevantTechniques:
  - T1485
  - T1036
query: |
  SecurityEvent
    | where EventID == 4688
    | where Process !~ "sdelete.exe"
    | where CommandLine has_all ("accepteula", "-r", "-s", "-q", "c:/")
    | where CommandLine !has ("sdelete")
    | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
    | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
    | extend AccountName = tostring(split(TargetAccount, @'\')[1]), AccountNTDomain = tostring(split(TargetAccount, @'\')[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: TargetAccount
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

| where EventID == 4688

Stage 3: `where`

| where Process !~ "sdelete.exe"

Stage 4: `where`

| where CommandLine has_all ("accepteula", "-r", "-s", "-q", "c:/")

Stage 5: `where`

| where CommandLine !has ("sdelete")

Stage 6: `extend` (3 consecutive steps)

| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(TargetAccount, @'\')[1]), AccountNTDomain = tostring(split(TargetAccount, @'\')[0])

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`sdelete`	`excludes:CommandLine` `field:"CommandLine" value:"sdelete"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-q` transforms: `term` corpus 9 (sigma 6, kusto 2, splunk 1) `-r` transforms: `term` corpus 13 (sigma 9, kusto 4) `-s` transforms: `term` corpus 10 (sigma 4, kusto 4, elastic 1, splunk 1) `accepteula` transforms: `term` corpus 7 (sigma 3, kusto 3, splunk 1) `c:/` transforms: `term`	`field:"CommandLine" kind:match`
`EventID`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`Process`	ne	`sdelete.exe`	`field:"Process" kind:ne value:"sdelete.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`
`AccountNTDomain`	`extend`
`AccountName`	`extend`