Potential re-named sdelete usage
| Id | 720d12c6-a08c-44c4-b18f-2236412d59b0 |
| Rulename | Potential re-named sdelete usage |
| Description | This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host’s C drive. A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host. |
| Severity | Low |
| Tactics | DefenseEvasion Impact |
| Techniques | T1485 T1036 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 1h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/Potentialre-namedsdeleteusage.yaml |
| Version | 1.0.3 |
| Arm template | 720d12c6-a08c-44c4-b18f-2236412d59b0.json |
SecurityEvent
| where EventID == 4688
| where Process !~ "sdelete.exe"
| where CommandLine has_all ("accepteula", "-r", "-s", "-q", "c:/")
| where CommandLine !has ("sdelete")
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(TargetAccount, @'\')[1]), AccountNTDomain = tostring(split(TargetAccount, @'\')[0])
relevantTechniques:
- T1485
- T1036
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/Potentialre-namedsdeleteusage.yaml
triggerOperator: gt
kind: Scheduled
entityMappings:
- fieldMappings:
- columnName: TargetAccount
identifier: FullName
- columnName: AccountName
identifier: Name
- columnName: AccountNTDomain
identifier: NTDomain
entityType: Account
- fieldMappings:
- columnName: Computer
identifier: FullName
- columnName: HostName
identifier: HostName
- columnName: HostNameDomain
identifier: DnsDomain
entityType: Host
requiredDataConnectors:
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
- dataTypes:
- SecurityEvent
connectorId: WindowsSecurityEvents
queryPeriod: 1h
query: |
SecurityEvent
| where EventID == 4688
| where Process !~ "sdelete.exe"
| where CommandLine has_all ("accepteula", "-r", "-s", "-q", "c:/")
| where CommandLine !has ("sdelete")
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(TargetAccount, @'\')[1]), AccountNTDomain = tostring(split(TargetAccount, @'\')[0])
version: 1.0.3
name: Potential re-named sdelete usage
description: |
'This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C drive.
A threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.'
tactics:
- DefenseEvasion
- Impact
severity: Low
triggerThreshold: 0
queryFrequency: 1h
status: Available
id: 720d12c6-a08c-44c4-b18f-2236412d59b0
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2023-02-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/720d12c6-a08c-44c4-b18f-2236412d59b0')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/720d12c6-a08c-44c4-b18f-2236412d59b0')]",
"properties": {
"alertRuleTemplateName": "720d12c6-a08c-44c4-b18f-2236412d59b0",
"customDetails": null,
"description": "'This detection looks for command line parameters associated with the use of Sysinternals sdelete (https://docs.microsoft.com/sysinternals/downloads/sdelete) to delete multiple files on a host's C drive.\nA threat actor may re-name the tool to avoid detection and then use it for destructive attacks on a host.'\n",
"displayName": "Potential re-named sdelete usage",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "TargetAccount",
"identifier": "FullName"
},
{
"columnName": "AccountName",
"identifier": "Name"
},
{
"columnName": "AccountNTDomain",
"identifier": "NTDomain"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "FullName"
},
{
"columnName": "HostName",
"identifier": "HostName"
},
{
"columnName": "HostNameDomain",
"identifier": "DnsDomain"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/Potentialre-namedsdeleteusage.yaml",
"query": "SecurityEvent\n | where EventID == 4688\n | where Process !~ \"sdelete.exe\"\n | where CommandLine has_all (\"accepteula\", \"-r\", \"-s\", \"-q\", \"c:/\")\n | where CommandLine !has (\"sdelete\")\n | extend HostName = tostring(split(Computer, \".\")[0]), DomainIndex = toint(indexof(Computer, '.'))\n | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)\n | extend AccountName = tostring(split(TargetAccount, @'\\')[1]), AccountNTDomain = tostring(split(TargetAccount, @'\\')[0])\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"severity": "Low",
"status": "Available",
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion",
"Impact"
],
"techniques": [
"T1036",
"T1485"
],
"templateVersion": "1.0.3",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}