tool
SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.
12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
88th percentile · 88% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
77 distinct rules cover the 2 techniques recorded for this tool. 43 Splunk · 34 Sigma.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Splunk | The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2025-03-25 | 2026-05-13 | 8b4e3d62-f743-11ee-9f6e-acde48001123 | |||
Detects when a EFS Fileshare Mount is modified or deleted. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Austin Songer @austinsonger | 2021-08-15 | 2022-10-09 | 6a7ba45c-63d8-473e-9736-2eaabff79964 | ||||
Identifies when an EKS cluster is created or deleted. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Austin Songer | 2021-08-16 | 2022-10-09 | 33d50d03-20ec-4b74-a74e-1e65a38af1c0 | ||||
Detects when a Container Registry is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 93e0ef48-37c8-49ed-a02c-038aab23628e | ||||
Identifies when a device or device configuration in azure is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-09-03 | 2022-10-09 | 46530378-f9db-4af9-a9e5-889c177d3881 | ||||
Detects when a Azure Kubernetes Cluster is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 9541f321-7cba-4b43-80fc-fbd1fb922808 | ||||
Identifies when a Azure Kubernetes network policy is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 08d6ac24-c927-4469-b3b7-2e422d6e3c43 | ||||
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 25cb259b-bbdc-4b87-98b7-90d7c72f8743 | ||||
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 7ee0b4aa-d8d4-4088-b661-20efdf41a04c | ||||
Identifies when ClusterRoles/Roles are being modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 818fee0c-e0ec-4e45-824e-83e4817b0887 | ||||
Identifies when a service account is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 12d027c3-b48c-4d9d-8bb6-a732200034b2 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
See what files are being deleted from flash file systems | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2023-01-04 | 71d65515-c436-43c0-841b-236b1f32c21e | - | |||
Splunk | The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-06-10 | 2026-05-13 | cd80a6ac-c9d9-11eb-8839-acde48001122 | |||
Splunk | The following analytic detects modifications to files with extensions commonly associated with ransomware. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick | 2019-10-16 | 2026-09-22 | a9e5c5db-db11-43ca-86a8-c852d1b2c0ec | |||
Splunk | The following analytic detects the creation of files with names commonly associated with ransomware notes. (...) | Hunting | stable | file_event | windows | Sysmon | - | medium | David Dorsey, Splunk | 2019-10-16 | 2026-07-02 | ada0f478-84a8-4641-a3f1-d82362d6bd71 | - | ||
Detects potential overwriting and deletion of a file using DD. | Generic | test | process_creation | linux | Sysmon | - | low | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-10-15 | 2022-07-07 | 2953194b-e33c-4859-b9e8-05948c167447 | ||||
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-12-26 | 2023-02-21 | 4b046706-5789-4673-b111-66f25fe99534 | ||||
Splunk | This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. (...) | Anomaly | experimental | dns | windows | Sysmon | - | medium | Jose Hernandez, Splunk | 2025-02-12 | 2026-05-13 | 2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e | |||
Splunk | This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. (...) | Anomaly | experimental | webserver | - | AWS | - | medium | Jose Hernandez, Splunk | 2025-02-12 | 2026-05-13 | 3a1d8f62-5b9c-4e7d-b8f3-9d6a8e2f5e1f | |||
Detects execution of the builtin "rmdir" command in order to delete directories. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-01-15 | 2023-03-07 | 41ca393d-538c-408a-ac27-cf1e038be80c | ||||
Splunk | The following analytic detects excessive file deletion events in the Windows Defender folder. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2022-01-21 | 2026-05-13 | b5baa09a-7a05-11ec-8da4-acde48001122 | |||
Detects the deletion of files by the Sysinternals SDelete utility. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) | 2020-05-02 | 2023-02-15 | 6ddab845-b1b8-49c2-bbf7-1a11967f64bc | ||||
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...) | Generic | stable | process_creation | linux | Sysmon | - | informational | Ömer Günal, oscd.community | 2020-10-07 | 2022-09-15 | 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57 | ||||
Detects execution of the builtin "del"/"erase" commands in order to delete files. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-01-15 | 2024-03-05 | 379fa130-190e-4c3f-b7bc-6c8e834485f3 | ||||
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security | - | high | Ecco, E.M. Anhaus, oscd.community | 2019-09-26 | 2023-09-09 | add64136-62e5-48ea-807e-88638d02df1e | ||||
Splunk | The following analytic detects when a user removes an organization from GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 94cb89aa-aec1-4585-91b1-affcdacf357e | |||
Splunk | The following analytic detects when a repository is archived in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 8367cb99-bae1-4748-ae3b-0927bb381424 | |||
Splunk | The following analytic detects when a user deletes a repository in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | f709e736-3e6c-492f-b865-bc7696cc24a7 | |||
Splunk | The following analytic detects when a repository is archived in GitHub Organizations. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 4f568a0e-896f-4d94-a2f7-fa6d82ab1f77 | |||
Splunk | The following analytic identifies when a repository is deleted within a GitHub organization. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71 | |||
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 , X__Junior (Nextron Systems) | 2021-12-02 | 2023-09-11 | 204b17ae-4007-471b-917b-b917b315c5db | ||||
Splunk | The following analytic detects the deletion of SSH keys on a Linux machine. (...) | Anomaly | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 | |||
Splunk | The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. (...) | Generic | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2023-02-08 | 2026-05-13 | 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c | |||
Splunk | The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. (...) | Generic | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-09 | 2026-10-02 | d1b74420-4cea-4752-a123-9b40dfcca49a | |||
Splunk | The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. (...) | Generic | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-05-13 | ce2bde4d-a1d4-4452-8c87-98440e5adfb3 | |||
Splunk | The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. (...) | Anomaly | stable | process_creation | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2023-02-08 | 2026-09-01 | b11d3979-b2f7-411b-bb1a-bd00e642173b | |||
Splunk | The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. (...) | Generic | stable | process_creation | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-02-15 | 2026-10-02 | 9b6aae5e-8d85-11ec-b2ae-acde48001122 | |||
Splunk | The following analytic detects the deletion of critical directories on a Linux machine using the `rm` command with argument rf. (...) | Generic | stable | process_creation | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-26 | 2026-05-13 | 33f89303-cc6f-49ad-921d-2eaea38a6f7a | |||
Splunk | The following analytic detects the deletion of cron jobs on a Linux machine. (...) | Anomaly | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | 3b132a71-9335-4f33-9932-00bb4f6ac7e8 | |||
Splunk | The following analytic detects the deletion of init daemon scripts on a Linux machine. (...) | Generic | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | 729aab57-d26f-4156-b97f-ab8dda8f44b1 | |||
Splunk | The following analytic detects the deletion of services on a Linux machine. (...) | Generic | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | b509bbd3-0331-4aaa-8e4a-d2affe100af6 | |||
Splunk | The following analytic detects the deletion of SSL certificates on a Linux machine. (...) | Anomaly | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | 839ab790-a60a-4f81-bfb3-02567063f615 | |||
Splunk | The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. (...) | Generic | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | e27fbc5d-0445-4c4a-bc39-87f060d5c602 | |||
Splunk | The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. (...) | Anomaly | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-12 | 2026-05-13 | 9d867448-2aff-4d07-876c-89409a752ff8 | |||
Splunk | The following analytic detects the deletion of Linux service unit configuration files by suspicious processes. (...) | Anomaly | stable | process_creation | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2023-02-08 | 2026-05-13 | 6c077f81-2a83-4537-afbc-0e62e3215d55 | |||
Splunk | The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. (...) | Generic | stable | process_creation | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2022-04-26 | 2026-05-13 | c1952cf1-643c-4965-82de-11c067cbae76 | |||
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files. | Generic | test | - | - | Azure Threat Management · Microsoft 365 | - | medium | austinsonger | 2021-08-19 | 2022-10-09 | 78a34b67-3c39-4886-8fb4-61c46dc18ecd |
72nd percentile · 72% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
65th percentile · 65% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 2 Enterprise techniques.
Technique Campaign use over its cumulative rule count.