Detection rules › Kusto Query Language

Sdelete deployed via GPO and run recursively

Source: upstream

'This query looks for the Sdelete process being run recursively after being deployed to a host via GPO. Attackers could use this technique to deploy Sdelete to multiple host and delete data on them.'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1485` Data Destruction

Event coverage

Provider	Event ID	Title
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

EventID eq "4688"

Stage 3: `where`

Process eq "svchost.exe"

Stage 4: `where`

or
  CommandLine match "-k GPSvcGroup"
  CommandLine match "-s gpsvc"

Stage 5: `extend`

Stage 6: `project`

Stage 7: `join`

Stage 8: `extend`

Stage 9: `extend`

Stage 10: `extend`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-k GPSvcGroup` `-s gpsvc`
`EventID`	eq	`4688`
`Process`	eq	`svchost.exe`

Sdelete deployed via GPO and run recursively

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: project

Stage 7: join

Stage 8: extend

Stage 9: extend

Stage 10: extend