Disk Wiping Tool Execution

Use case development / Ensure Business Continuity / Detect Destructive Actions

sigma

Detection rule

title: Disk Wiping Tool Detection
status: experimental
description: Detects execution of known disk wiping utilities
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\sdelete.exe'
      - '\cipher.exe'
    CommandLine|contains:
      - '/w:'
      - '-z'
      - '-s'
  condition: selection
falsepositives:
  - Legitimate secure deletion
level: critical
tags:
  - attack.impact
  - attack.t1485

Test cases

• Execute sdelete on temp folder

False positive guidance

Coordinate with data destruction policies.

Detection course