Overwriting the File with Dev Zero or Null — Detection Rule

Detects overwriting (effectively wiping/deleting) of a file.

Read the full analysis on IntelFusions