Cross-source coverage

T1485 / ATT&CK

Data Destruction

174 rules · 171 families across 11 sources.

From MITRE ATT&CK 19.2

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.

Tactics
Impact
Platforms
Containers · ESXi · IaaS · Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogAWS:CloudTrailesxi:vmkerneldocker:events

How MITRE says to detect it DET0146

Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns

Windows Analytic 0411

Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=23

Linux Analytic 0412

Massive recursive deletions or overwrites via `rm -rf`, `shred`, `dd`, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.

  • auditd:SYSCALL unlink, unlinkat, openat, write
  • auditd:SYSCALL execve

macOS Analytic 0413

Destruction via `rm -rf`, overwrite with `dd` or `srm`, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.

  • macos:unifiedlog exec rm -rf|dd if=/dev|srm|file unlink
  • macos:unifiedlog process.*exit.*code

IaaS Analytic 0414

Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with `Delete*` or `TerminateInstances`.

  • AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances

ESXi Analytic 0415

Adversary destroys virtual disks (VMDK), images, or VMs by invoking `vim-cmd`, deleting datastore contents, or purging snapshots.

  • esxi:vmkernel file delete|datastore purge

Containers Analytic 0416

Container process executes destructive file operations inside volume mounts or host paths. Includes `rm -rf /mnt/volumes/`, container breakout followed by host deletion attempts.

  • auditd:SYSCALL unlink, unlinkat, rmdir
  • docker:events container exec rm|container stop --force

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 174 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

41 rules
Detection Severity Format
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action High Elastic TOML
Azure Storage Account Deletions by User High Elastic TOML
First-Time Destructive MongoDB Command from a Client IP High Elastic TOML
Potential Ransomware Note File Dropped via SMB High Elastic TOML
Potential System Tampering via File Modification High Elastic TOML
Successful AMQP Multi-Queue Purge Burst High Elastic TOML
Suspicious File Renamed via SMB High Elastic TOML
AWS Account Closed Medium Elastic TOML
AWS CloudWatch Log Group Deletion Medium Elastic TOML
AWS CloudWatch Log Stream Deletion Medium Elastic TOML

+ 31 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

38 rules
Detection Severity Format
ASL AWS Defense Evasion PutBucketLifecycle Undefined SPL
AWS Bedrock Delete Knowledge Base Undefined SPL
AWS Defense Evasion PutBucketLifecycle Undefined SPL
Common Ransomware Extensions Undefined SPL
Common Ransomware Notes Undefined SPL
Detect DNS Query to Decommissioned S3 Bucket Undefined SPL
Detect Web Access to Decommissioned S3 Bucket Undefined SPL
Excessive File Deletion In WinDefender Folder Undefined SPL
GitHub Enterprise Remove Organization Undefined SPL
GitHub Enterprise Repository Archived Undefined SPL

+ 28 more from splunk/security_content → showing the 10 highest-severity

panther-labs/panther-analysis

36 rules
Detection Severity Format
AWS RDS Automated Backup Deleted Critical Panther Python
AWS RDS Instance or Cluster Deleted High Panther Python
AWS RDS Snapshot Deleted High Panther Python
AWS S3 Security Control Disabling High Panther Python
Azure Recovery Services Protection Container Deleted High Panther Python
Azure Storage Account Blob Versioning Disabled High Panther Python
Azure Storage Account Deleted High Panther Python
Azure Storage Blob Soft Delete Disabled High Panther Python
Azure Storage Container Soft Delete Disabled High Panther Python
Azure Storage Immutability Policy Deleted High Panther Python

+ 26 more from panther-labs/panther-analysis → showing the 10 highest-severity

SigmaHQ/sigma

20 rules
Detection Severity Format
Fsutil Suspicious Invocation High Sigma
Potential BlackByte Ransomware Activity High Sigma
Potential File Overwrite Via Sysinternals SDelete High Sigma
Renamed Sysinternals Sdelete Execution High Sigma
AWS EFS Fileshare Mount Modified or Deleted Medium Sigma
Azure Device or Configuration Modified or Deleted Medium Sigma
Azure Kubernetes Network Policy Change Medium Sigma
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted Medium Sigma
Azure Kubernetes Secret or Config Object Access Medium Sigma
Azure Kubernetes Sensitive Role Access Medium Sigma

+ 10 more from SigmaHQ/sigma → showing the 10 highest-severity

Wazuh Core Ruleset

10 rules
Detection Severity Format
AWS Cloudtrail: - - high number of deleted objects. · rule 80252 High Wazuh XML
Netscreen Erase sequence started. High Wazuh XML
File deleted. Medium Wazuh XML
Docker: Network deleted · docker.Action = destroy Low Wazuh XML
Docker: Plugin removed · docker.Action = remove Low Wazuh XML
Docker: Secret '' removed · docker.Action = remove Low Wazuh XML
Docker: Service deleted · docker.Action = remove Low Wazuh XML
GCP storage bucket deleted. Low Wazuh XML
Registry Key Entry Deleted. Low Wazuh XML
Registry Value Entry Deleted. Low Wazuh XML

socfortress/Wazuh-Rules

9 rules · 8 families
Detection Severity Format
Detects overwriting (effectively wiping/deleting) of a file. 2 variants High Wazuh XML
Detects overwriting (effectively wiping/deleting) of a file. 2 variants High Wazuh XML
Possible data destruction via dd overwriting log files - T1485 High Wazuh XML
Sysmon - Event 1: Process creation · Cipher Wipe Deleted Files (T1485) High Wazuh XML
Sysmon - Event 1: Process creation · Plink ESXi Snapshot Delete (T1485) High Wazuh XML
Sysmon - Event 1: Process creation · SDelete Overwrite (T1485) High Wazuh XML
dd command used with /dev/zero or /dev/random (possible wipe) - T1485 Medium Wazuh XML
Sysmon - Event 23: FileDelete (A file delete was detected) by · system.eventID = 23 Low Wazuh XML
Sysmon - Event 23: FileDelete (A file delete was detected) by · win.system.eventID = 23 Low Wazuh XML

chronicle/detection-rules

7 rules
Detection Severity Format
aws_kms_key_disabled_or_scheduled_for_deletion High YARA-L
gcp_multiple_kms_keys_disabled_or_destroyed High YARA-L
gcp_multiple_secrets_deleted High YARA-L
github_enterprise_deleted High YARA-L
google_workspace_multiple_files_deleted_from_google_drive High YARA-L
github_organization_removed_from_enterprise Medium YARA-L
github_repository_archived_or_deleted Low YARA-L

Azure/Azure-Sentinel

5 rules
Detection Severity Format
Sdelete deployed via GPO and run recursively (ASIM Version) Medium KQL
Potential re-named sdelete usage (ASIM Version) Low KQL
Azure Storage Mass File Deletion Undefined KQL
GitHub First Time Repo Delete Undefined KQL
GitHub Mass Deletion of repos or projects Undefined KQL

elastic/protections-artifacts

5 rules
Detection Severity Format
Potential Data wiping Attack Behavior Undefined Elastic TOML
Potential Ransomware Note File Undefined Elastic TOML
Potential Ransomware Note File via SMB Undefined Elastic TOML
Suspicious Critical System Files Modification Undefined Elastic TOML
Suspicious Recursive File Deletion via Built-In Utilities Undefined Elastic TOML

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
(Mass) Cloud Resource Deletion Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

falcosecurity/rules

1 rule
Detection Severity Format
Remove Bulk Data from Disk Medium Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.