Elastic low stable eql

Potential Secure File Deletion via SDelete Utility

Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations.

View Source

Detection Logic

file where host.os.type == "windows" and event.type == "change" and file.name : "*AAA.AAA"

Field Validations

Loading…

Comments (0)

Loading comments...