Techniques › T1485

T1485 Data Destruction

impact — Containers, ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

• DET0146 Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns v1.0
  AN0411 Windows

  Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion

  Tunable: TargetFilename ProcessCommandLine VolumeThreshold TimeWindow
  AN0412 Linux

  Massive recursive deletions or overwrites via rm -rf, shred, dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.

  auditd:SYSCALL unlink, unlinkat, openat, write → DC0040 File Deletion

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: ExecutablePath DeletedPathPattern SyscallBurstRate
  AN0413 macOS

  Destruction via rm -rf, overwrite with dd or srm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.

  macos:unifiedlog exec rm -rf|dd if=/dev|srm|file unlink → DC0040 File Deletion

  macos:unifiedlog process.*exit.*code → DC0033 Process Termination

  Tunable: CommandPattern EntropyChangeRate
  AN0414 IaaS

  Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with Delete* or TerminateInstances.

  AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances → DC0022 Cloud Storage Deletion

  Tunable: OperationType UserAgent RegionScope
  AN0415 ESXi

  Adversary destroys virtual disks (VMDK), images, or VMs by invoking vim-cmd, deleting datastore contents, or purging snapshots.

  esxi:vmkernel file delete|datastore purge → DC0098 Volume Deletion

  Tunable: DatastorePath InitiatingUser
  AN0416 Containers

  Container process executes destructive file operations inside volume mounts or host paths. Includes rm -rf /mnt/volumes/, container breakout followed by host deletion attempts.

  auditd:SYSCALL unlink, unlinkat, rmdir → DC0040 File Deletion

  docker:events container exec rm|container stop --force → DC0064 Command Execution

  Tunable: MountPoint ContainerImage

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1485

Sub-techniques