CmdID

CmdID / Commands

sdelete

Securely delete file/directory from disk, or clean the free space on a volume/physical disk. tldr-pages

On Windows 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Delete files with 3 passes

sdelete -p 3 path\to\file1 path\to\file2 ...Identify

Trips 1 Sigma rule: highPotential File Overwrite Via Sysinternals SDelete by frack113

Delete folders and its subdirectories with 1 pass (default)

sdelete -s path\to\directory1 path\to\directory2 ...Identify

Trips 1 Sigma rule: highPotential File Overwrite Via Sysinternals SDelete by frack113

Clean the free space of volume D: with 3 passes

sdelete -p 3 D:Identify

Trips 1 Sigma rule: highPotential File Overwrite Via Sysinternals SDelete by frack113

Clean the free space with zeros of physical disk 2, which should not contain any volumes to be cleaned

sdelete -z 2Identify

What detects it

Sigma process creation rules that name sdelete
highPotential File Overwrite Via Sysinternals SDeletefrack113
highRenamed Sysinternals Sdelete ExecutionFlorian Roth (Nextron Systems)
mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)