Techniques › T1485
T1485 Data Destruction
impact — Containers, ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
6
analytics
20
Sigma rules tagged attack.t1485
6
KEV CVEs mapped here
<p>Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.</p><p>Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.</p><p>To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..</p><p>In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-25257 | Fortinet FortiWeb | secondary impact | Mapped | 2025-07-18 |
| CVE-2025-25181 | Advantive VeraCore | primary impact | Mapped | 2025-03-10 |
| CVE-2025-21391 | Microsoft Windows | primary impact | Mapped | 2025-02-11 |
| CVE-2021-39226 | Grafana Labs Grafana | primary impact | Mapped | 2022-08-25 |
| CVE-2018-7600 | Drupal Drupal Core | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0146 Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns v1.0
AN0411 WindowsAdversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.Tunable:
TargetFilenameProcessCommandLineVolumeThresholdTimeWindowAN0412 LinuxMassive recursive deletions or overwrites viarm -rf,shred,dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.Tunable:ExecutablePathDeletedPathPatternSyscallBurstRateAN0413 macOSDestruction viarm -rf, overwrite withddorsrm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.Tunable:CommandPatternEntropyChangeRateAN0414 IaaSAdversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls withDelete*orTerminateInstances.AWS:CloudTrailDeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances→ DC0022 Cloud Storage DeletionTunable:OperationTypeUserAgentRegionScopeAN0415 ESXiAdversary destroys virtual disks (VMDK), images, or VMs by invokingvim-cmd, deleting datastore contents, or purging snapshots.Tunable:DatastorePathInitiatingUserAN0416 ContainersContainer process executes destructive file operations inside volume mounts or host paths. Includesrm -rf /mnt/volumes/, container breakout followed by host deletion attempts.Tunable:MountPointContainerImage
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1485
Author: Daniel Degasperi '@d4ns4n_'
· 2025-06-04 · logsource: product=windows service=application · 00321fee-ca72-4cce-b011-5415af3b9960
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43
Identifies when a Azure Kubernetes network policy is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2
Identifies when a service account is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-07-07) · logsource: product=linux category=process_creation · 2953194b-e33c-4859-b9e8-05948c167447
Detects potential overwriting and deletion of a file using DD.
Author: Austin Songer
· 2021-08-16 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 33d50d03-20ec-4b74-a74e-1e65a38af1c0
Identifies when an EKS cluster is created or deleted.
Author: Jakob Weinzettl, oscd.community
· 2019-10-23 · logsource: product=linux service=auditd · 37222991-11e9-4b6d-8bdf-60fbe48f753e
Detects overwriting (effectively wiping/deleting) of a file.
Author: Thomas Patzke
· 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Author: Austin Songer @austinsonger
· 2021-09-03 (modified 2022-10-09) · logsource: product=azure service=activitylogs · 46530378-f9db-4af9-a9e5-889c177d3881
Identifies when a device or device configuration in azure is modified or deleted.
Author: frack113
· 2021-12-26 (modified 2023-02-21) · logsource: product=windows category=process_creation · 4b046706-5789-4673-b111-66f25fe99534
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Author: Austin Songer @austinsonger
· 2021-08-15 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 6a7ba45c-63d8-473e-9736-2eaabff79964
Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
Author: austinsonger
· 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · 78a34b67-3c39-4886-8fb4-61c46dc18ecd
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887
Identifies when ClusterRoles/Roles are being modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e
Detects when a Container Registry is created or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808
Detects when a Azure Kubernetes Cluster is created or deleted.
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-02-08) · logsource: product=windows category=process_creation · 999e8307-a775-4d5f-addc-4855632335be
Detects command line patterns used by BlackByte ransomware in different operations
Author: frack113
· 2021-06-03 (modified 2023-02-28) · logsource: product=windows category=process_creation · a4824fca-976f-4964-b334-0621379e84c4
Detects the use of SDelete to erase a file not the free space
Author: Ecco, E.M. Anhaus, oscd.community
· 2019-09-26 (modified 2023-09-09) · logsource: product=windows category=process_creation · add64136-62e5-48ea-807e-88638d02df1e
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Author: Florian Roth (Nextron Systems)
· 2022-09-06 (modified 2026-06-29) · logsource: product=windows category=process_creation · c1d867fe-8d95-4487-aab4-e53f2d339f90
Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)
Sub-techniques
| ID | Name | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1485.001 | Lifecycle-Triggered Deletion | 0 | 0 |