Techniques › T1485 › T1485.001
T1485.001 Lifecycle-Triggered Deletion
impact — IaaS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1485.001
0
KEV CVEs mapped here
<p>Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.</p><p>Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time. If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once.</p><p>For example, in AWS environments, an adversary with the
PutLifecycleConfiguration permission may use the PutBucketLifecycle API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day. In addition to destroying data for purposes of extortion and Financial Theft, adversaries may also perform this action on buckets storing cloud logs for Indicator Removal.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0041 Detection of Lifecycle Policy Modifications for Triggered Deletion in IaaS Cloud Storage v1.0
AN0117 IaaSAdversary with write access to storage modifies lifecycle policies (e.g., via PutBucketLifecycle) to schedule rapid object deletion across one or more storage buckets. This is often used to trigger impact (destruction), remove logs (defense evasion), or force extortion (ransomware).AWS:CloudTrail
PutBucketLifecycle, PutLifecycleConfiguration, SetBucketLifecycle, storage.buckets.update→ DC0023 Cloud Storage ModificationTunable:LifecycleExpirationDaysTargetBucketPrincipalTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1485.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1485) 20
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Daniel Degasperi '@d4ns4n_'
· 2025-06-04 · logsource: product=windows service=application · 00321fee-ca72-4cce-b011-5415af3b9960
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43
Identifies when a Azure Kubernetes network policy is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2
Identifies when a service account is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-07-07) · logsource: product=linux category=process_creation · 2953194b-e33c-4859-b9e8-05948c167447
Detects potential overwriting and deletion of a file using DD.
Author: Austin Songer
· 2021-08-16 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 33d50d03-20ec-4b74-a74e-1e65a38af1c0
Identifies when an EKS cluster is created or deleted.
Author: Jakob Weinzettl, oscd.community
· 2019-10-23 · logsource: product=linux service=auditd · 37222991-11e9-4b6d-8bdf-60fbe48f753e
Detects overwriting (effectively wiping/deleting) of a file.
Author: Thomas Patzke
· 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Author: Austin Songer @austinsonger
· 2021-09-03 (modified 2022-10-09) · logsource: product=azure service=activitylogs · 46530378-f9db-4af9-a9e5-889c177d3881
Identifies when a device or device configuration in azure is modified or deleted.
Author: frack113
· 2021-12-26 (modified 2023-02-21) · logsource: product=windows category=process_creation · 4b046706-5789-4673-b111-66f25fe99534
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Author: Austin Songer @austinsonger
· 2021-08-15 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 6a7ba45c-63d8-473e-9736-2eaabff79964
Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
Author: austinsonger
· 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · 78a34b67-3c39-4886-8fb4-61c46dc18ecd
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887
Identifies when ClusterRoles/Roles are being modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e
Detects when a Container Registry is created or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808
Detects when a Azure Kubernetes Cluster is created or deleted.
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-02-08) · logsource: product=windows category=process_creation · 999e8307-a775-4d5f-addc-4855632335be
Detects command line patterns used by BlackByte ransomware in different operations
Author: frack113
· 2021-06-03 (modified 2023-02-28) · logsource: product=windows category=process_creation · a4824fca-976f-4964-b334-0621379e84c4
Detects the use of SDelete to erase a file not the free space
Author: Ecco, E.M. Anhaus, oscd.community
· 2019-09-26 (modified 2023-09-09) · logsource: product=windows category=process_creation · add64136-62e5-48ea-807e-88638d02df1e
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Author: Florian Roth (Nextron Systems)
· 2022-09-06 (modified 2026-06-29) · logsource: product=windows category=process_creation · c1d867fe-8d95-4487-aab4-e53f2d339f90
Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)