T0809 Data Destruction — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0758 Detection of Data Destruction

AN1890 Analytic 1890

Real-time monitoring identifies a process performing rapid, bulk deletion or overwrite of files across multiple Industrial Control System (ICS)-relevant directories within a short time window, by a process not associated with documented data retention management, correlated with a system crash shortly after. Documented in CaddyWiper, deployed via GPO alongside Industroyer2. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2139 Analytic 2139

Real-time monitoring identifies rapid, bulk deletion of files across Industrial Control System (ICS) data directories on a Linux asset, by a User Identifier (UID) not associated with documented data retention management, correlated with worm-based propagation indicators consistent with documented Linux wiper malware (Awfulshred, SoloShred). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2194 Analytic 2194

Real-time monitoring identifies an Industrial Control System (ICS) network device receiving a configuration erase command from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or outside a change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2248 Analytic 2248

Real-time monitoring identifies an Industrial Control System (ICS) protocol command sequence that erases device memory, from a source not in the approved engineering workstation list, where the device subsequently becomes unresponsive or requires re-commissioning. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.