detection.wiki

Data Destruction T1485

Tactic: Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Events covered

16 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 5Process terminated
SysmonEvent ID 11FileCreate
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 22DNSEvent (DNS query)
SysmonEvent ID 23FileDelete (File Delete archived)
SysmonEvent ID 26FileDeleteDetected (File Delete logged)
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4658The handle to an object was closed.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4689A process has exited.
Defender-DeviceProcessEventsanyProcess activity (any)
Linux-AuditdEvent ID 1309EXECVE
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

Patterns shared across the 177 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (181 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType27eq 21, in 6, wildcard 1ModifyDBInstance, connection_accepted, creation, exec, DELETE
data_stream.dataset26eq 26aws.cloudtrail, azure.activitylogs, github.audit, gcp.audit, o365.audit
operationName26eq 25, in 1MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE, DELETEBLOB, MICROSOFT.COMPUTE/DISKS/DELETE, MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE, MICROSOFT.COMPUTE/SNAPSHOTS/DELETE
aws::eventName18eq 12, in 5, starts_with 1PutBucketVersioning, PutBucketLifecycle, PutBucketLogging, CreateCluster, CreateKey
resultType18in 18Succeeded, Success
event.outcome17eq 14, in 3success, Success
sourcetype17eq 17, in 4o365:management:activity, ms:o365:reporting:messagetrace, o365:reporting:messagetrace, auditd, httpevent
CommandLine15contains 13, in 3, ends_with 1, match 1-r, -s, -k gpsvcgroup, -q, of=
TargetFilename15starts_with 8, in 6, contains 1, ends_with 1, wildcard 1/etc/ssl/certs/, c:\users\, *.7z, *.backup*, *.bak
EventID14eq 11, in 323, 26, 4688, 1, DestroyCryptoKeyVersion
aws::eventSource13eq 13s3.amazonaws.com, rds.amazonaws.com, SecurityComplianceCenter, bedrock.amazonaws.com, eks.amazonaws.com
Provider_Name12eq 12rds.amazonaws.com, logs.amazonaws.com, s3.amazonaws.com, MSSQLSERVER$AUDIT, SecurityComplianceCenter
process_name10eq 8, regex_match 2(?i)\x5ccipher\.exe, rm, shred, dd, gw-audit
event.type8eq 7, in 1change, deletion, start
Image7ends_with 4, eq 1, is_not_null 1, starts_with 1/bin/dd, /dd, /rm, /shred, /usr/bin/dd

Top indicator values (577 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
resultTypein
Succeeded
1851
resultTypein
Success
1851
event.outcomeeq
success
14251
data_stream.dataseteq
aws.cloudtrail
12141
data_stream.dataseteq
azure.activitylogs
734
data_stream.dataseteq
github.audit
418
event_actioneq
deleted
77
Workloadeq
Exchange
620
aws::eventSourceeq
s3.amazonaws.com
617
aws::eventSourceeq
rds.amazonaws.com
323
sourcetypeeq
o365:management:activity
680
CommandLinecontains
-r
513
CommandLinecontains
-s
410
Operationeq
HardDelete
44
m365::Folder.Pathin
\\Recoverable Items\\Deletions
44
m365::Folder.Pathin
\\Sent Items
44
sourcetypein
ms:o365:reporting:messagetrace
44
sourcetypein
o365:reporting:messagetrace
44
EventIDeq
4688
3313
EventIDin
23
36
EventIDin
26
36
OriginalFileNameeq
sdelete.exe
33
Provider_Nameeq
rds.amazonaws.com
39
aws::eventNameeq
PutBucketVersioning
36
event.outcomein
Success
337
event.outcomein
success
338
event.typeeq
change
377
operationNameeq
MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE
33
process_ideq
4
311
security_result.actioneq
ALLOW
3102

Exclusions (87 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLinecontains
sdelete
2
CommandLinecontains
-c
1
CommandLinecontains
-h
1
CommandLinecontains
-z
1
CommandLinecontains
/\?
1
aws::sourceIPAddressends_with
destination.address
2
aws::userAgenteq
AWS Internal
2
Imageends_with
\sdelete.exe
1
Imageends_with
\sdelete64.exe
1
Imagein
/.envbuilder/bin/envbuilder
1
Imagein
/kaniko/executor
1
Imagein
/opt/kaniko/executor
1
Imagein
/opt/kaspersky/kesl/libexec/kesl
1
Imagein
/usr/bin/gnurm
1
Imagein
/usr/bin/podman
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 21 rules

Elastic 35 rules

Splunk 40 rules

Kusto 33 rules

YARA-L 7 rules

Panther 41 rules