Applied Cybernetics Group
T1485 — Data Destruction
- Technique
T1485- Tactics
- Impact
- MISP citations
- 0
- KEV CVEs mapped
- 6
- Community rules
- 20
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1485
MITRE description
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018). In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
- Potential BlackByte Ransomware Activity (emerging-threats)
- AWS EFS Fileshare Mount Modified or Deleted (core)
- AWS EKS Cluster Created or Deleted (core)
- Azure Container Registry Created or Deleted (core)
- Azure Device or Configuration Modified or Deleted (core)
- Azure Kubernetes Cluster Created or Deleted (core)
- Azure Kubernetes Network Policy Change (core)
- Azure Kubernetes Sensitive Role Access (core)
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted (core)
- Azure Kubernetes Secret or Config Object Access (core)
- Azure Kubernetes Service Account Modified or Deleted (core)
- Microsoft 365 - Unusual Volume of File Deletion (core)
- Overwriting the File with Dev Zero or Null (core)
- DD File Overwrite (core)
- MSSQL Destructive Query (core)
- Potential Secure Deletion with SDelete (core)
- Deleted Data Overwritten Via Cipher.EXE (core)
- Fsutil Suspicious Invocation (core)
- Renamed Sysinternals Sdelete Execution (core)
- Potential File Overwrite Via Sysinternals SDelete (core)