Technique on mitre.org

T1485: Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..

In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

supply_chain: PT-CR-1773: SupplyChain_Important_Branch_Remove: A user deleted a tracked branch mongo_database: PT-CR-527: MongoDB_Drop_Database: An attempt to delete a database mongo_database: PT-CR-531: MongoDB_Mass_Drop_Table: An attempt to mass delete database tables acronis: PT-CR-2239: Acronis_Mass_Drop_Machine_Or_Backup_Plan: Attempt to delete multiple backups hashicorp: PT-CR-2139: Hashicorp_Vault_Important_Engines_Manipulation: Attackers can delete or change parameters of important storages (engines) to access them hashicorp: PT-CR-2142: Hashicorp_Vault_Important_Secrets_Deleted: Attackers can delete important secrets to disrupt availability or functionality of specific systems network_devices_compromise: PT-CR-1819: S_Terra_Gate_Delete_Files: A file or folder is deleted clickhouse: PT-CR-1578: ClickHouse_Drop_Database: An attempt to drop a database is detected clickhouse: PT-CR-1577: ClickHouse_Drop_Multiple_Tables: An attempt to drop multiple database tables is detected apache_cassandra_database: PT-CR-2089: Apache_Cassandra_Drop_Keyspace: Attempt to drop a keyspace. This may indicate an attacker trying to violate data integrity. microsoft_exchange: PT-CR-2353: Exchange_Mass_Deletion_Of_Mailboxes: A user deleted mailboxes in Exchange. This could be an attacker's attempt to make system and network resources unavailable. microsoft_exchange: PT-CR-2357: Exchange_Remove_Dismount_Mailbox_Database: Deleting or dismounting an Exchange database. This could be an attacker's attempt to disrupt availability of system and network resources. vmware_aria: PT-CR-2384: Aria_Operations_Mass_Remove_Resources: Mass removal of resources can indicate an attacker attempting to conceal their actions with the Aria Operations monitoring objects vmware_aria: PT-CR-2374: Aria_Operations_Remove_Critical_Resource: The removal of a critical resource can indicate an attacker attempting to conceal their actions with the Aria Operations monitoring objects grafana_labs: PT-CR-2329: Grafana_Organization_Removed: An organization was deleted in Grafana, which can lead to the loss of critical data

Detection

ID	DS0020	Data source and component	Snapshot: Snapshot Deletion	Description	Monitor for unexpected deletion of a snapshot (ex: AWS delete-snapshot)

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor for newly executed processes of binaries that could be involved in data destruction activity, such as SDelete.

ID	DS0030	Data source and component	Instance: Instance Deletion	Description	Monitor for unexpected deletion of an instance (ex: instance.delete within GCP Audit Logs)

ID	DS0034	Data source and component	Volume: Volume Deletion	Description	Monitor for unexpected deletion of a cloud volume (ex: AWS delete-volume)

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments for binaries that could be involved in data destruction activity, such as SDelete.

ID	DS0007	Data source and component	Image: Image Deletion	Description	Monitor for unexpected deletion of a virtual machine image (ex: Azure Compute Service Images DELETE)

ID	DS0022	Data source and component	File: File Modification	Description	Monitor for changes made to a large quantity of files for unexpected modifications in user directories and under C:\Windows\System32.

ID	DS0022	Data source and component	File: File Deletion	Description	Monitor for unexpected deletion to a file (ex: Sysmon EID 23)

ID	DS0010	Data source and component	Cloud Storage: Cloud Storage Deletion	Description	Monitor for unexpected deletion of a cloud storage infrastructure, such as the `DeleteDBCluster` and `DeleteGlobalCluster` events in AWS, or a high quantity of data deletion events, such as `DeleteBucket`. Many of these events within a short period of time may indicate malicious activity.

ID	Data source and component	Description
DS0020	Snapshot: Snapshot Deletion	Monitor for unexpected deletion of a snapshot (ex: AWS delete-snapshot)
DS0009	Process: Process Creation	Monitor for newly executed processes of binaries that could be involved in data destruction activity, such as SDelete.
DS0030	Instance: Instance Deletion	Monitor for unexpected deletion of an instance (ex: instance.delete within GCP Audit Logs)
DS0034	Volume: Volume Deletion	Monitor for unexpected deletion of a cloud volume (ex: AWS delete-volume)
DS0017	Command: Command Execution	Monitor executed commands and arguments for binaries that could be involved in data destruction activity, such as SDelete.
DS0007	Image: Image Deletion	Monitor for unexpected deletion of a virtual machine image (ex: Azure Compute Service Images DELETE)
DS0022	File: File Modification	Monitor for changes made to a large quantity of files for unexpected modifications in user directories and under C:\Windows\System32.
DS0022	File: File Deletion	Monitor for unexpected deletion to a file (ex: Sysmon EID 23)
DS0010	Cloud Storage: Cloud Storage Deletion	Monitor for unexpected deletion of a cloud storage infrastructure, such as the `DeleteDBCluster` and `DeleteGlobalCluster` events in AWS, or a high quantity of data deletion events, such as `DeleteBucket`. Many of these events within a short period of time may indicate malicious activity.

Mitigation

ID	M1053	Name	Data Backup	Description	Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

ID	Name	Description
M1053	Data Backup	Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.