{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1485","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"08819087a9b26e93b83995b3ea0d9bb1fe33014baa6191d6f4ee979006731db3","description":"Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\n\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1485","external_id":"T1485"},{"source_name":"DOJ  - Cisco Insider","description":"DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.","url":"https://www.justice.gov/usao-ndca/pr/san-jose-man-pleads-guilty-damaging-cisco-s-network"},{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"},{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"FireEye Shamoon Nov 2016","description":"FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"},{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"},{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"Data Destruction - Threat Post","description":"Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.","url":"https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/"},{"source_name":"Symantec Shamoon 2012","description":"Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.","url":"https://www.symantec.com/connect/blogs/shamoon-attacks"}],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1485.001","id":"T1485.001","name":"Lifecycle-Triggered Deletion","page":"techniques/enterprise/T1485.001/"}],"telemetry":[{"id":"DC0022","name":"Cloud Storage Deletion","page":"telemetry/DC0022/","kind":"attack_component","category":"Cloud storage","description":"Deletion of cloud storage infrastructure such as a bucket or container.","collection_focus":"Collect bucket/container administrative deletion and final resource state. Object-delete events may be supporting context but are not the same infrastructure operation.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["action","bucket","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0022","collector":"illustrative-lab-collector","observation":{"action":"delete_bucket","bucket":"lab-bucket","actor":"lab-admin","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0040","name":"File Deletion","page":"telemetry/DC0040/","kind":"attack_component","category":"Endpoint activity","description":"Deletion of a file, with path and responsible process where available.","collection_focus":"Prefer Sysmon FileDeleteDetected (26) when content retention is not needed; FileDelete (23) also archives files and requires a storage/privacy plan.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","archived"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0040","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"delete","archived":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0033","name":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component","category":"Endpoint activity","description":"Termination of a process, correlated to its earlier creation.","collection_focus":"Collect Sysmon ProcessTerminate (5) and join on ProcessGuid; do not assume every provider records an exit code.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","process_id","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0098","name":"Volume Deletion","page":"telemetry/DC0098/","kind":"attack_component","category":"Cloud control plane","description":"Deletion of a block-storage volume.","collection_focus":"Collect volume-delete APIs and final state; join backup/attachment inventory to assess consequences.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["volume_id","action","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0098","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","action":"delete","actor":"lab-admin","result":"requested"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1485","technique_page":"techniques/enterprise/T1485/","page":"detections/enterprise/T1485/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"6a7ba45c-63d8-473e-9736-2eaabff79964","title":"AWS EFS Fileshare Mount Modified or Deleted","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/6a7ba45c-63d8-473e-9736-2eaabff79964.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"33d50d03-20ec-4b74-a74e-1e65a38af1c0","title":"AWS EKS Cluster Created or Deleted","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/33d50d03-20ec-4b74-a74e-1e65a38af1c0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml","author":"Austin Songer","kind":"sigma"},{"id":"93e0ef48-37c8-49ed-a02c-038aab23628e","title":"Azure Container Registry Created or Deleted","status":"test","level":"low","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/93e0ef48-37c8-49ed-a02c-038aab23628e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"46530378-f9db-4af9-a9e5-889c177d3881","title":"Azure Device or Configuration Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/46530378-f9db-4af9-a9e5-889c177d3881.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"9541f321-7cba-4b43-80fc-fbd1fb922808","title":"Azure Kubernetes Cluster Created or Deleted","status":"test","level":"low","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/9541f321-7cba-4b43-80fc-fbd1fb922808.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"08d6ac24-c927-4469-b3b7-2e422d6e3c43","title":"Azure Kubernetes Network Policy Change","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/08d6ac24-c927-4469-b3b7-2e422d6e3c43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"818fee0c-e0ec-4e45-824e-83e4817b0887","title":"Azure Kubernetes Sensitive Role Access","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/818fee0c-e0ec-4e45-824e-83e4817b0887.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"25cb259b-bbdc-4b87-98b7-90d7c72f8743","title":"Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/25cb259b-bbdc-4b87-98b7-90d7c72f8743.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/7ee0b4aa-d8d4-4088-b661-20efdf41a04c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/12d027c3-b48c-4d9d-8bb6-a732200034b2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"78a34b67-3c39-4886-8fb4-61c46dc18ecd","title":"Microsoft 365 - Unusual Volume of File Deletion","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/78a34b67-3c39-4886-8fb4-61c46dc18ecd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml","author":"austinsonger","kind":"sigma"},{"id":"37222991-11e9-4b6d-8bdf-60fbe48f753e","title":"Overwriting the File with Dev Zero or Null","status":"stable","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/37222991-11e9-4b6d-8bdf-60fbe48f753e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_dd_delete_file.yml","author":"Jakob Weinzettl, oscd.community","kind":"sigma"},{"id":"2953194b-e33c-4859-b9e8-05948c167447","title":"DD File Overwrite","status":"test","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/2953194b-e33c-4859-b9e8-05948c167447.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"00321fee-ca72-4cce-b011-5415af3b9960","title":"MSSQL Destructive Query","status":"experimental","level":"medium","logsource":{"product":"windows","service":"application","definition":"Requirements: MSSQL audit policy must be enabled in order to receive this event (event id 33205)"},"data_path":"data/detection-rules/00321fee-ca72-4cce-b011-5415af3b9960.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/mssqlserver/win_mssql_destructive_query.yml","author":"Daniel Degasperi '@d4ns4n_'","kind":"sigma"},{"id":"39a80702-d7ca-4a83-b776-525b1f86a36d","title":"Potential Secure Deletion with SDelete","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/39a80702-d7ca-4a83-b776-525b1f86a36d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"4b046706-5789-4673-b111-66f25fe99534","title":"Deleted Data Overwritten Via Cipher.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4b046706-5789-4673-b111-66f25fe99534.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml","author":"frack113","kind":"sigma"},{"id":"add64136-62e5-48ea-807e-88638d02df1e","title":"Fsutil Suspicious Invocation","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/add64136-62e5-48ea-807e-88638d02df1e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml","author":"Ecco, E.M. Anhaus, oscd.community","kind":"sigma"},{"id":"c1d867fe-8d95-4487-aab4-e53f2d339f90","title":"Renamed Sysinternals Sdelete Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c1d867fe-8d95-4487-aab4-e53f2d339f90.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"a4824fca-976f-4964-b334-0621379e84c4","title":"Potential File Overwrite Via Sysinternals SDelete","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a4824fca-976f-4964-b334-0621379e84c4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1485-1","technique_id":"T1485","title":"T1485 Data Destruction","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#impact","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":188,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L188","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"88de1bcb51ce6b7cfb12c3c16188e1ef8ee81a5c06a3c016898387019925a171","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(delete_operation BY actor_or_process, 5m) >= threshold OR MATCH(delete_on_protected_resource) -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Database Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#86-database-audit-logs"},{"title":"Cloud Object-Storage Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#108-cloud-object-storage-access-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1485-1","technique_id":"T1485","title":"Files, records, or resources deleted or destroyed — T1485 Data Destruction","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#data-destruction","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":118,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L118","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"d1253bf0794550adfa841abf08430f347599566e53df6c6ec75a2b9c4539e12f","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"actor or process deletion stream.","expected_behavior":"deletions occur at bounded rates and within known workflows.","deviation":"extreme deletion volume, burst, or abrupt transition from read/write to deletion.","anomaly_types":[{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Database Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#86-database-audit-logs"},{"title":"Cloud Object-Storage Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#108-cloud-object-storage-access-logs"}],"context_references":[{"title":"LockBit joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-165a-lockbit.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/230614.pdf"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}],"strategies":[{"id":"DET0146","name":"Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns","url":"https://attack.mitre.org/detectionstrategies/DET0146","stix_id":"x-mitre-detection-strategy--c54fdf95-c7ac-4ca4-bd99-273e56da20a5","relationship_id":"relationship--31ece083-4856-4057-bfca-5dd17221b34b","description":"","analytics":[{"id":"AN0411","name":"Analytic 0411","guidance":"Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0411","platforms":["Windows"],"tuning":[{"field":"TargetFilename","description":"Filter file deletion activity to sensitive locations (e.g., %System32%, Documents, DB paths)."},{"field":"ProcessCommandLine","description":"Tune for aggressive overwrite flags (e.g., /w, /q, /s) or temp file overwrites."},{"field":"VolumeThreshold","description":"Threshold of unique file deletions or modifications within time window."},{"field":"TimeWindow","description":"Correlate rapid file delete/overwrite behavior from same process/user."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0411","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0411","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0411","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0411","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0040","component":"File Deletion","name":"WinEventLog:Sysmon","channel":"EventCode=23","platforms":["Windows"],"analytic_id":"AN0411","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0411","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"}]},{"id":"AN0412","name":"Analytic 0412","guidance":"Massive recursive deletions or overwrites via `rm -rf`, `shred`, `dd`, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0412","platforms":["Linux"],"tuning":[{"field":"ExecutablePath","description":"Focus on binaries like shred, dd, wipe, custom wipers, or bash execution chains."},{"field":"DeletedPathPattern","description":"Tune for critical mount points or home/data directories."},{"field":"SyscallBurstRate","description":"Rate of unlink/unlinkat syscalls to indicate mass deletion in a short period."}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"auditd:SYSCALL","channel":"unlink, unlinkat, openat, write","platforms":["Linux"],"analytic_id":"AN0412","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0412","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0412","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0412","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0413","name":"Analytic 0413","guidance":"Destruction via `rm -rf`, overwrite with `dd` or `srm`, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0413","platforms":["macOS"],"tuning":[{"field":"CommandPattern","description":"Focus on high-risk patterns in temporary directories or key system paths."},{"field":"EntropyChangeRate","description":"Optional anomaly detection on overwritten files with high-entropy payloads."}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"macos:unifiedlog","channel":"exec rm -rf|dd if=/dev|srm|file unlink","platforms":["macOS"],"analytic_id":"AN0413","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0413","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0033","component":"Process Termination","name":"macos:unifiedlog","channel":"process.*exit.*code","platforms":["macOS"],"analytic_id":"AN0413","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0413","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0033/"}]},{"id":"AN0414","name":"Analytic 0414","guidance":"Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with `Delete*` or `TerminateInstances`.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0414","platforms":["IaaS"],"tuning":[{"field":"OperationType","description":"Correlate multiple destructive API calls over short intervals."},{"field":"UserAgent","description":"Flag non-console/API clients initiating destructive behavior."},{"field":"RegionScope","description":"Observe whether deletions span multiple regions or org accounts."}],"log_sources":[{"component_id":"DC0022","component":"Cloud Storage Deletion","name":"AWS:CloudTrail","channel":"DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances","platforms":["IaaS"],"analytic_id":"AN0414","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0414","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0022/"}]},{"id":"AN0415","name":"Analytic 0415","guidance":"Adversary destroys virtual disks (VMDK), images, or VMs by invoking `vim-cmd`, deleting datastore contents, or purging snapshots.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0415","platforms":["ESXi"],"tuning":[{"field":"DatastorePath","description":"Targeted deletion of critical VMDKs or VM configuration files."},{"field":"InitiatingUser","description":"Detect deletions from users outside normal maintenance windows."}],"log_sources":[{"component_id":"DC0098","component":"Volume Deletion","name":"esxi:vmkernel","channel":"file delete|datastore purge","platforms":["ESXi"],"analytic_id":"AN0415","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0415","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0098/"}]},{"id":"AN0416","name":"Analytic 0416","guidance":"Container process executes destructive file operations inside volume mounts or host paths. Includes `rm -rf /mnt/volumes/`, container breakout followed by host deletion attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0416","platforms":["Containers"],"tuning":[{"field":"MountPoint","description":"Identify when deletions occur inside persistent or shared volume paths."},{"field":"ContainerImage","description":"Correlate destructive behavior with unknown or untrusted container sources."}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"auditd:SYSCALL","channel":"unlink, unlinkat, rmdir","platforms":["Containers"],"analytic_id":"AN0416","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0416","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0064","component":"Command Execution","name":"docker:events","channel":"container exec rm|container stop --force","platforms":["Containers"],"analytic_id":"AN0416","source_url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0416","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0022","name":"Cloud Storage Deletion","tag":"Cloud Storage Deletion","page":"telemetry/DC0022/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0040","name":"File Deletion","tag":"File Deletion","page":"telemetry/DC0040/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0033","name":"Process Termination","tag":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component"},{"id":"DC0098","name":"Volume Deletion","tag":"Volume Deletion","page":"telemetry/DC0098/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0364","name":"RawDisk","page":"tools/S0364/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0195","name":"SDelete","page":"tools/S0195/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0364","name":"RawDisk","page":"tools/S0364/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0195","name":"SDelete","page":"tools/S0195/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) 2 contains a \"Destroy\" plug-in that destroys data stored on victim hard drives by overwriting file contents.(Citation: Securelist BlackEnergy Feb 2015)(Citation: ESET BlackEnergy Jan 2016)","relationship_id":"relationship--d5166d3e-246b-473c-9ff0-c5cc97dd91de","references":[{"source_name":"Securelist BlackEnergy Feb 2015","description":"Baumgartner, K. and Garnaeva, M.. (2015, February 17). BE2 extraordinary plugins, Siemens targeting, dev fails. Retrieved March 24, 2016.","url":"https://securelist.com/be2-extraordinary-plugins-siemens-targeting-dev-fails/68838/"},{"source_name":"ESET BlackEnergy Jan 2016","description":"Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}]},{"id":"S0139","name":"PowerDuke","url":"https://attack.mitre.org/software/S0139","kind":"malware","description":"[PowerDuke](https://attack.mitre.org/software/S0139) has a command to write random data across a file and delete it.(Citation: Volexity PowerDuke November 2016)","relationship_id":"relationship--5135ba35-04b7-4cfc-bc6c-03f63206e757","references":[{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) attempts to overwrite operating system files and disk structures with image files.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016) In a later variant, randomly generated data was used for data overwrites.(Citation: Unit 42 Shamoon3 2018)(Citation: McAfee Shamoon December 2018)","relationship_id":"relationship--4b4ac061-dee5-44f3-b0f5-021889eae45e","references":[{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"},{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"FireEye Shamoon Nov 2016","description":"FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"},{"source_name":"McAfee Shamoon December 2018","description":"Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/"},{"source_name":"Symantec Shamoon 2012","description":"Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.","url":"https://www.symantec.com/connect/blogs/shamoon-attacks"}]},{"id":"S0195","name":"SDelete","url":"https://attack.mitre.org/software/S0195","kind":"tool","description":"[SDelete](https://attack.mitre.org/software/S0195) deletes data in a way that makes it unrecoverable.(Citation: Microsoft SDelete July 2016)","relationship_id":"relationship--cfb4c18a-d76e-47fd-a89b-a4b4fce1c643","references":[{"source_name":"Microsoft SDelete July 2016","description":"Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.","url":"https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"[Proxysvc](https://attack.mitre.org/software/S0238) can overwrite files indicated by the attacker before deleting them.(Citation: McAfee GhostSecret)","relationship_id":"relationship--f0c53ce3-a265-4da9-a553-c5f2faffa5b8","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) can overwrite files with random data before deleting them.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--333bd465-8713-4918-b60d-6128c52cbf04","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0341","name":"Xbash","url":"https://attack.mitre.org/software/S0341","kind":"malware","description":"[Xbash](https://attack.mitre.org/software/S0341) has destroyed Linux-based databases as part of its ransomware capabilities.(Citation: Unit42 Xbash Sept 2018)\t","relationship_id":"relationship--1c8208ad-b295-4e39-a928-40fc49f68fb4","references":[{"source_name":"Unit42 Xbash Sept 2018","description":"Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"}]},{"id":"S0364","name":"RawDisk","url":"https://attack.mitre.org/software/S0364","kind":"tool","description":"[RawDisk](https://attack.mitre.org/software/S0364) was used in [Shamoon](https://attack.mitre.org/software/S0140) to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)","relationship_id":"relationship--d7d25f15-7451-4092-acb5-1a22095bc3cd","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"}]},{"id":"S0365","name":"Olympic Destroyer","url":"https://attack.mitre.org/software/S0365","kind":"malware","description":"[Olympic Destroyer](https://attack.mitre.org/software/S0365) overwrites files locally and on remote shares.(Citation: Talos Olympic Destroyer 2018)(Citation: US District Court Indictment GRU Unit 74455 October 2020) ","relationship_id":"relationship--7767d727-fba8-4b7a-b7fe-137ed9261680","references":[{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) has a disk wiper module that targets files other than those in the Windows directory.(Citation: Kaspersky StoneDrill 2017)","relationship_id":"relationship--fe2aa2b2-6508-40e1-b0cf-13c66ae43064","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) has the capability to destroy files and folders.(Citation: Kaspersky Sodin July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--31bf8ae4-e757-462c-aa30-c4a9dd92c677","references":[{"source_name":"Kaspersky Sodin July 2019","description":"Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"Secureworks GandCrab and REvil September 2019","description":"Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Picus Sodinokibi January 2020","description":"Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.","url":"https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"},{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604)’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.(Citation: Dragos Crashoverride 2017)","relationship_id":"relationship--16873550-3105-4ce5-92fc-7b8127e47b5d","references":[{"source_name":"Dragos Crashoverride 2017","description":"Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.","url":"https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) deletes system files to make the OS unbootable. [KillDisk](https://attack.mitre.org/software/S0607) also targets and deletes files with 35 different file extensions.(Citation: ESEST Black Energy Jan 2016)","relationship_id":"relationship--e45c0080-ee1c-4ef1-813f-d58b83de4a8b","references":[{"source_name":"ESEST Black Energy Jan 2016","description":"Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.","url":"http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) can delete specified files from a targeted system.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--063b76d3-a002-44a1-aafa-d626008ee786","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--e0cbaae4-9a39-4da4-a0a2-8c60dfa8e0c8","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.(Citation: Microsoft WhisperGate January 2022)(Citation: Crowdstrike WhisperGate January 2022)(Citation: Cybereason WhisperGate February 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)","relationship_id":"relationship--13576b41-ec77-418c-b581-d3fa461df941","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"},{"source_name":"Crowdstrike WhisperGate January 2022","description":"Crowdstrike. (2022, January 19). Technical Analysis of the WhisperGate Malicious Bootloader. Retrieved March 10, 2022.","url":"https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware"},{"source_name":"Cybereason WhisperGate February 2022","description":"Cybereason Nocturnus. (2022, February 15). Cybereason vs. WhisperGate and HermeticWiper. Retrieved March 10, 2022.","url":"https://www.cybereason.com/blog/cybereason-vs.-whispergate-wiper"},{"source_name":"Unit 42 WhisperGate January 2022","description":"Falcone, R. et al.. (2022, January 20). Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. Retrieved March 10, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"},{"source_name":"Microsoft WhisperGate January 2022","description":"MSTIC. (2022, January 15). Destructive malware targeting Ukrainian organizations. Retrieved March 10, 2022.","url":"https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"},{"source_name":"Medium S2W WhisperGate January 2022","description":"S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}]},{"id":"S0693","name":"CaddyWiper","url":"https://attack.mitre.org/software/S0693","kind":"malware","description":"[CaddyWiper](https://attack.mitre.org/software/S0693) can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.(Citation: ESET CaddyWiper March 2022)(Citation: Cisco CaddyWiper March 2022)","relationship_id":"relationship--a65cc371-4fa4-48e9-b95d-22ac81d67085","references":[{"source_name":"ESET CaddyWiper March 2022","description":"ESET. (2022, March 15). CaddyWiper: New wiper malware discovered in Ukraine. Retrieved March 23, 2022.","url":"https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine"},{"source_name":"Cisco CaddyWiper March 2022","description":"Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022.","url":"https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. [HermeticWiper](https://attack.mitre.org/software/S0697) can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.(Citation: ESET Hermetic Wizard March 2022)","relationship_id":"relationship--40ad3b2e-e88c-43a2-82c5-666e8ae568e4","references":[{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}]},{"id":"S1125","name":"AcidRain","url":"https://attack.mitre.org/software/S1125","kind":"malware","description":"[AcidRain](https://attack.mitre.org/software/S1125) performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it.(Citation: AcidRain JAGS 2022)","relationship_id":"relationship--28d36206-062f-42be-93a1-f9cf2910c3c4","references":[{"source_name":"AcidRain JAGS 2022","description":"Juan Andres Guerrero-Saade and Max van Amerongen, SentinelOne. (2022, March 31). AcidRain | A Modem Wiper Rains Down on Europe. Retrieved March 25, 2024.","url":"https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/"}]},{"id":"S1133","name":"Apostle","url":"https://attack.mitre.org/software/S1133","kind":"malware","description":"[Apostle](https://attack.mitre.org/software/S1133) initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, <code>wiper-action</code>. [Apostle](https://attack.mitre.org/software/S1133) writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--f24943ee-409c-45eb-8277-7a7dc197eddd","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1134","name":"DEADWOOD","url":"https://attack.mitre.org/software/S1134","kind":"malware","description":"[DEADWOOD](https://attack.mitre.org/software/S1134) overwrites files on victim systems with random data to effectively destroy them.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--479ec00e-ce63-4a2f-8489-e0df55238e88","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1135","name":"MultiLayer Wiper","url":"https://attack.mitre.org/software/S1135","kind":"malware","description":"[MultiLayer Wiper](https://attack.mitre.org/software/S1135) deletes files on network drives, but corrupts and overwrites with random data files stored locally.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--9b0efe89-4888-4c10-8a91-2ed78038a7cb","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"S1167","name":"AcidPour","url":"https://attack.mitre.org/software/S1167","kind":"malware","description":"[AcidPour](https://attack.mitre.org/software/S1167) can perform an in-depth wipe of victim filesystems and attached storage devices through either data overwrite or calling various IOCTLS to erase them, similar to [AcidRain](https://attack.mitre.org/software/S1125).(Citation: SentinelOne AcidPour 2024)","relationship_id":"relationship--f907268d-bcc8-4a55-81d6-0ad35a765879","references":[{"source_name":"SentinelOne AcidPour 2024","description":"Juan Andrés Guerrero-Saade & Tom Hegel. (2024, March 21). AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine. Retrieved November 25, 2024.","url":"https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) can initiate a destructive payload depending on the operating system check through resizing and reformatting portions of the victim machine's disk, leading to system instability and potential data corruption.(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--e723abac-5d58-4370-9f6e-4db8fb9697cb","references":[{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S9008","name":"Shai-Hulud","url":"https://attack.mitre.org/software/S9008","kind":"malware","description":"[Shai-Hulud](https://attack.mitre.org/software/S9008) has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder.(Citation: Palo Alto Unit 42 Shai-Hulud November 2025)(Citation: Socket Shai-Hulud November 2025) [Shai-Hulud](https://attack.mitre.org/software/S9008) has also utilized the `shred` command on Linux devices.(Citation: Microsoft Shai-Hulud December 2025)","relationship_id":"relationship--3184811d-4b00-4fdd-aa4b-5c16eb3294ed","references":[{"source_name":"Palo Alto Unit 42 Shai-Hulud November 2025","description":"Justin Moore. (2025, November 25). \"Shai-Hulud\" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.","url":"https://unit42.paloaltonetworks.com/npm-supply-chain-attack/"},{"source_name":"Microsoft Shai-Hulud December 2025","description":"Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/"},{"source_name":"Socket Shai-Hulud November 2025","description":"Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"}]},{"id":"S9030","name":"SameCoin","url":"https://attack.mitre.org/software/S9030","kind":"malware","description":"[SameCoin](https://attack.mitre.org/software/S9030) can overwrite designated files on targeted systems with random bytes.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--46592001-5c4e-4b12-9fb7-d63e8f8c075d","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has overwritten files with 16-byte sequences of random data generated by the Mersenne Twister algorithm using the Microsoft Windows native `CreateFileW()` function to open the file and the `SetFilePointerEx()` and `WriteFile()` functions to overwrite the file.(Citation: CERT Polska) Additionally, versions of [DynoWiper](https://attack.mitre.org/software/S9038) can also delete files using the `DeleteFileW` API.(Citation: ESET DynoWiper Update JAN 2026)\n","relationship_id":"relationship--3e18cf3c-e185-4f9f-a413-7cfc89f28b48","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"},{"source_name":"ESET DynoWiper Update JAN 2026","description":"ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.","url":"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"}]},{"id":"S9039","name":"LazyWiper","url":"https://attack.mitre.org/software/S9039","kind":"malware","description":"[LazyWiper](https://attack.mitre.org/software/S9039) has overwritten files with pseudorandom 32‑byte sequences written at 16‑byte intervals making the file unrecoverable.(Citation: CERT Polska)","relationship_id":"relationship--c576e2b9-dc3f-4c4a-8465-41e92a93c90a","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--ee5c102e-b129-4fc2-a785-5c98cf7436e1","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has wiped data on devices that fall within specified parameters to include those that resolve to specific geolocations including Iran and Israel.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026) [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has also implemented a dead-man’s switch that wipes the victims home directory if the operator revokes a GitHub token created by the adversary. (Citation: Flashpoint Mini Shai-Hulud MAY 2026)","relationship_id":"relationship--cbca9348-6e7b-49bd-88f5-66b0ec02e5d0","references":[{"source_name":"Flashpoint Mini Shai-Hulud MAY 2026","description":"Flashpoint. (2026, May 28). The Mini Shai-Hulud Worm and the New Era of CI/CD Exploitation. Retrieved July 16, 2026.","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has used a custom secure delete function to overwrite file contents with data from heap memory.(Citation: Novetta Blockbuster)","relationship_id":"relationship--27323a25-ef80-4519-b934-19f5ff090c70","references":[{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used [CaddyWiper](https://attack.mitre.org/software/S0693), [SDelete](https://attack.mitre.org/software/S0195), and the [BlackEnergy](https://attack.mitre.org/software/S0089) KillDisk component to overwrite files on victim systems. (Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)(Citation: Mandiant-Sandworm-Ukraine-2022) Additionally, [Sandworm Team](https://attack.mitre.org/groups/G0034) has used the JUNKMAIL tool to overwrite files with null bytes.(Citation: mandiant_apt44_unearthing_sandworm)","relationship_id":"relationship--e85a5fe7-cbfe-44b1-b297-d02f531c5fb1","references":[{"source_name":"ESET Telebots June 2017","description":"Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source_name":"Mandiant-Sandworm-Ukraine-2022","description":"Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.","url":"https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"},{"source_name":"mandiant_apt44_unearthing_sandworm","description":"Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source_name":"US-CERT Ukraine Feb 2016","description":"US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020.","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has used a custom secure delete function to make deleted files unrecoverable.(Citation: FireEye APT38 Oct 2018)","relationship_id":"relationship--77cd972c-459f-4cac-ae21-3cc1a96df09e","references":[{"source_name":"FireEye APT38 Oct 2018","description":"FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has deleted the target's systems and resources both on-premises and in the cloud.(Citation: MSTIC DEV-0537 Mar 2022)(Citation: NCC Group LAPSUS Apr 2022)","relationship_id":"relationship--1b996e11-03b7-48fc-9ce2-cd08fdf0d07d","references":[{"source_name":"NCC Group LAPSUS Apr 2022","description":"Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has destroyed data and backup files.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)","relationship_id":"relationship--38938866-d940-4223-b811-e3b8420f6408","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","description":"Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has conducted data wiping attacks on compromised systems.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: SPECOPS Outpost24 Handala Hack Stryker March 2026)(Citation: DOJ FBI Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026)","relationship_id":"relationship--ec2d8154-cb3b-4d65-82ba-4e6c81697306","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","description":"Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source_name":"SPECOPS Outpost24 Handala Hack Stryker March 2026","description":"David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source_name":"DOJ FBI Handala Hack March 2026","description":"DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source_name":"Palo Alto VOID MANTICORE Iran Cyber Threats March 2026","description":"Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"[TeamPCP](https://attack.mitre.org/groups/G1056) has deployed privileged DaemonSets to delete files on Kubernetes clusters and has executed recursive file deletions on non-containerized hosts.(Citation: Palo Alto TeamPCP MAR 2026)\n","relationship_id":"relationship--7e54d357-1cc6-45cf-8fb5-e85d20cc436c","references":[{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has executed the `DeleteBucket` API call to delete buckets.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)   ","relationship_id":"relationship--f105ba9c-5c64-4728-9f97-aa3b6d8ed274","references":[{"source_name":"Unit42KelleyVaya_BlingLibra_Aug2024","description":"Kelley, M., Vaya, C. (2024, August 23). Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026.","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., `PutLifecycleConfiguration` in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the `PutBucketLifecycle` API call. ","relationship_id":"relationship--b6baac4e-00ab-41e6-a035-d2f7d511e476","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data destruction in cloud environments by ensuring that only authenticated actions can irreversibly delete storage or machine images.","relationship_id":"relationship--ad410271-db42-45b4-a5a5-6133bba495ce","references":[]},{"id":"M1053","name":"Data Backup","url":"https://attack.mitre.org/mitigations/M1053","kind":"course-of-action","description":"Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.","relationship_id":"relationship--af1e6f67-b513-42f7-b5df-dfb04b38caf6","references":[{"source_name":"Ready.gov IT DRP","description":"Ready.gov. (n.d.). IT Disaster Recovery Plan. Retrieved March 15, 2019.","url":"https://www.ready.gov/business/implementation/IT"}]}],"candidates":[{"id":"1207ddff-f25b-41b3-aa0e-7c26d2b546d1","name":"ESXi - Delete VM Snapshots","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml","description":"Deletes all snapshots for all Virtual Machines on an ESXi Host\n[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#inhibit%20recovery)\n","inputs":{"vm_host":{"description":"Specify the host name or IP of the ESXi server.","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on the ESXi server.","type":"string","default":"root"},"vm_pass":{"description":"Specify the privileged user's password.","type":"string","default":"password"},"plink_file":{"description":"Path to Plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"}},"dependencies":[{"description":"Check if we have plink\n"}],"source_definition_sha256":"6afad676a762a2840a263b6ee95e8acacd91f8d3f754a0cd1264e4628ef4ec4f"},{"id":"321fd25e-0007-417f-adec-33232252be19","name":"Overwrite deleted data on C drive","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml","description":"RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover.\nThis process is very slow and test execution may timeout. \nhttps://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware\nhttps://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4\n","inputs":{},"dependencies":[],"source_definition_sha256":"0ef0b787032c09b60ddb3c42cd6c1113bbb10d179ea4f6e422d22cd4cfc3293b"},{"id":"38deee99-fd65-4031-bec8-bfa4f9f26146","name":"FreeBSD/macOS/Linux - Overwrite file with DD","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml","description":"Overwrites and deletes a file using DD.\nTo stop the test, break the command with CTRL/CMD+C.\n","inputs":{"overwrite_source":{"description":"Path of data source to overwrite with","type":"path","default":"/dev/zero"},"file_to_overwrite":{"description":"Path of file to overwrite and remove","type":"path","default":"/var/log/syslog"}},"dependencies":[],"source_definition_sha256":"4f792757adea8a9d18ed23d385d0a389ba628b692a0c6b376965995900662ce2"},{"id":"476419b5-aebf-4366-a131-ae3e8dae5fc2","name":"Windows - Overwrite file with SysInternals SDelete","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml","description":"Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, \"Files deleted: 1\" will be displayed in\nthe powershell session along with other information about the file that was deleted.\n","inputs":{"sdelete_exe":{"description":"Path of sdelete executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\Sdelete\\sdelete.exe"},"file_to_delete":{"description":"Path of file to delete","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1485.txt"}},"dependencies":[{"description":"Secure delete tool from SysInternals must exist on disk at specified location (#{sdelete_exe})\n"}],"source_definition_sha256":"4829071621f68389ed735700601eb3d35cd307feaa16245d2f12ddc4601133e3"},{"id":"4ac71389-40f4-448a-b73f-754346b3f928","name":"GCP - Delete Bucket","platforms":["iaas:gcp"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":4,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml","description":"This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team.\n\nIdentifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.\nThis atomic will create a bucket then delete the bucket.\n\nReference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml\n","inputs":{"project_id":{"description":"ID of the GCP Project you to execute the command against.","type":"string","default":"atomic-test-1"},"bucket_name":{"description":"The name of the bucket to delete.","type":"string","default":"atomic-red-team-bucket"}},"dependencies":[{"description":"Requires gcloud\n"},{"description":"Check if user is logged in \n"},{"description":"Check if terraform is installed.\n"},{"description":"Create dependency resources using terraform\n"}],"source_definition_sha256":"68c96e337d4bb69f9b7d3cfcb74396608e381ba03ba70636aa9d6b0130fb4018"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1561.001":"/ttp-simulation/techniques/enterprise/T1561.001/","T1561.002":"/ttp-simulation/techniques/enterprise/T1561.002/","T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1003":"/ttp-simulation/techniques/enterprise/T1003/","T1021.002":"/ttp-simulation/techniques/enterprise/T1021.002/","T1485":"/ttp-simulation/techniques/enterprise/T1485/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1485","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0022","collector":"illustrative-lab-collector","observation":{"action":"delete_bucket","bucket":"lab-bucket","actor":"lab-admin","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0040","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"delete","archived":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0098","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","action":"delete","actor":"lab-admin","result":"requested"}}]}}