Potential File Overwrite Via Sysinternals SDelete — Detection Rule

Detects the use of SDelete to erase a file not the free space

Read the full analysis on IntelFusions