VOOZH about

URL: https://attack.mitre.org/software/S0195/

⇱ SDelete, Software S0195 | MITRE ATT&CK®

ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 and submit your proposal.
  1. Home
  2. Software
  3. SDelete

SDelete

SDelete is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. [1]

ID: S0195
ⓘ
Type: TOOL
ⓘ
Platforms: Windows
Version: 1.2
Created: 18 April 2018
Last Modified: 25 April 2025
Enterprise Layer
download view 👁 Image

Techniques Used

Domain ID Name Use
Enterprise T1485 Data Destruction

SDelete deletes data in a way that makes it unrecoverable.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

SDelete deletes data in a way that makes it unrecoverable.[1]

Groups That Use This Software

ID Name References
G0016 APT29

[2]
G0034 Sandworm Team

Sandworm Team has used SDelete for wartime operations in 2022-2023.[3]
G0080 Cobalt Group

[4]
G0053 FIN5

[5]
G0091 Silence

[6]

References

×