Data Destruction `T1485`

Tactic: Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Events covered

20 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 22	DNSEvent (DNS query)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4658	The handle to an object was closed.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
Defender-CloudAppEvents	any	Cloud app activity
Defender-DeviceProcessEvents	any	Process activity
ESF	exec	Process Execution
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1327	PROCTITLE
MSSQLSERVER	Event ID 33205	Event ID 33205
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 194 rules share fields, values, and exclusions.

Fields filtered most (202 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	35	`eq` 28, `in` 8, `starts_with` 1, `wildcard` 1	`creation`, `exec`, `ModifyDBInstance`, `rename`, `DeleteDBClusterSnapshot`
`data_stream.dataset`	31	`eq` 31	`aws.cloudtrail`, `azure.activitylogs`, `github.audit`, `gcp.audit`, `network_traffic.amqp`
`operationName`	26	`eq` 25, `in` 1	`microsoft.storage/storageaccounts/blobservices/write`, `deleteblob`, `microsoft.compute/disks/delete`, `microsoft.compute/restorepointcollections/delete`, `microsoft.compute/snapshots/delete`
`event.outcome`	20	`eq` 20	`success`
`aws::eventName`	18	`eq` 12, `in` 5, `ne` 1, `starts_with` 1	`PutBucketVersioning`, `PutBucketLogging`, `putbucketlifecycle`, `CreateKey`, `DeleteBucket`
`resultType`	18	`in` 18	`Succeeded`, `Success`
`TargetFilename`	17	`starts_with` 9, `in` 6, `wildcard` 2, `contains` 1, `ends_with` 1	`c:\users\`, `/etc/ssl/certs/`, `.7z`, `.backup`, `.bak`
`sourcetype`	17	`eq` 17, `in` 4	`o365:management:activity`, `ms:o365:reporting:messagetrace`, `o365:reporting:messagetrace`, `auditd`, `httpevent`
`CommandLine`	16	`contains` 14, `in` 3, `ends_with` 1, `match` 1, `wildcard` 1	`-r`, `-s`, `-k gpsvcgroup`, `-q`, `of=`
`Provider_Name`	16	`eq` 15, `in` 1	`rds.amazonaws.com`, `kms.amazonaws.com`, `logs.amazonaws.com`, `s3.amazonaws.com`, `account.amazonaws.com`
`EventID`	14	`eq` 11, `in` 3	`23`, `26`, `4688`, `1`, `DestroyCryptoKeyVersion`
`aws::eventSource`	13	`eq` 13	`s3.amazonaws.com`, `rds.amazonaws.com`, `bedrock.amazonaws.com`, `eks.amazonaws.com`, `elasticfilesystem.amazonaws.com`
`process_name`	11	`eq` 9, `regex_match` 2	`rm`, `(?i)\x5ccipher\.exe`, `shred`, `dd`, `gw-audit`
`event_action`	10	`eq` 7, `in` 3	`deleted`, `created`, `modified`
`Image`	9	`ends_with` 4, `is_not_null` 3, `eq` 1, `starts_with` 1	`/bin/dd`, `/dd`, `/rm`, `/shred`, `/usr/bin/dd`

Top indicator values (699 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS Account Closed elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EFS File System Deleted elasticAWS KMS Customer Managed Key Disabled or Scheduled for Deletion elasticAWS KMS Imported Key Material Deleted elasticAWS Lambda Function Deletion elasticAWS RDS DB Instance or Cluster Deleted elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled elasticAWS RDS Snapshot Deleted elasticAWS S3 Bucket Expiration Lifecycle Configuration Added elasticAWS S3 Unauthenticated Bucket Access by Rare Source elasticAWS SQS Queue Purge elasticAzure Automation Runbook Deleted +5 more rules	20	369
`resultType`	`in`	`Succeeded` pantherAzure Disk Deleted pantherAzure Key Vault Deleted pantherAzure Key Vault Key Permanently Purged pantherAzure Key Vault Permanently Purged pantherAzure Log Analytics Workspace Deleted pantherAzure Network Security Configuration Modified or Deleted pantherAzure Recovery Services Protection Container Deleted pantherAzure Resource Group Deleted pantherAzure Restore Point Collection Deleted pantherAzure SQL Server Deleted pantherAzure Storage Account Blob Versioning Disabled pantherAzure Storage Account Deleted pantherAzure Storage Blob Soft Delete Disabled pantherAzure Storage Container Soft Delete Disabled pantherAzure Storage Immutability Policy Deleted +3 more rules	18	51
`resultType`	`in`	`Success` pantherAzure Disk Deleted pantherAzure Key Vault Deleted pantherAzure Key Vault Key Permanently Purged pantherAzure Key Vault Permanently Purged pantherAzure Log Analytics Workspace Deleted pantherAzure Network Security Configuration Modified or Deleted pantherAzure Recovery Services Protection Container Deleted pantherAzure Resource Group Deleted pantherAzure Restore Point Collection Deleted pantherAzure SQL Server Deleted pantherAzure Storage Account Blob Versioning Disabled pantherAzure Storage Account Deleted pantherAzure Storage Blob Soft Delete Disabled pantherAzure Storage Container Soft Delete Disabled pantherAzure Storage Immutability Policy Deleted +3 more rules	18	51
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Account Closed elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EFS File System Deleted elasticAWS KMS Customer Managed Key Disabled or Scheduled for Deletion elasticAWS KMS Imported Key Material Deleted elasticAWS Lambda Function Deletion elasticAWS RDS DB Instance or Cluster Deleted elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled elasticAWS RDS Snapshot Deleted elasticAWS S3 Bucket Expiration Lifecycle Configuration Added elasticAWS S3 Unauthenticated Bucket Access by Rare Source elasticAWS SQS Queue Purge elasticPotential AWS S3 Bucket Ransomware Note Uploaded	15	169
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure Automation Runbook Deleted elasticAzure Compute Snapshot Deletion by Unusual User and Resource Group elasticAzure Compute Snapshot Deletions by User elasticAzure Event Hub Deleted elasticAzure Resource Group Deleted elasticAzure Storage Account Deletion by Unusual User elasticAzure Storage Account Deletions by User	7	39
`data_stream.dataset`	`eq`	`github.audit` elasticGitHub Repository Deleted elasticHigh Number of Closed Pull Requests by User elasticHigh Number of Protected Branch Force Pushes by User elasticSeveral Failed Protected Branch Force Pushes by User	4	18
`event_action`	`eq`	`deleted` splunkLinux Account Manipulation Of SSH Config and Keys splunkLinux Deletion Of Cron Jobs splunkLinux Deletion Of Init Daemon Script splunkLinux Deletion Of Services splunkLinux Deletion of SSL Certificate splunkLinux High Frequency Of File Deletion In Boot Folder splunkLinux High Frequency Of File Deletion In Etc Folder	7	8
`Workload`	`eq`	`exchange` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior splunkO365 Email Send Attachments Excessive Volume	6	20
`aws::eventSource`	`eq`	`s3.amazonaws.com` pantherAWS S3 Security Control Disabling pantherS3 Bucket Encryption Deleted pantherS3 Bucket Logging Disabled pantherS3 Bucket Replication Deleted pantherS3 Bucket Versioning Suspended pantherS3 MFA Delete Disabled	6	17
`aws::eventSource`	`eq`	`rds.amazonaws.com` pantherAWS RDS Automated Backup Deleted pantherAWS RDS Instance or Cluster Deleted pantherAWS RDS Snapshot Deleted	3	23
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior splunkO365 Email Send Attachments Excessive Volume	6	80
`CommandLine`	`contains`	`-r` sigmamacOS Data Destruction Tools kustoPotential re-named sdelete usage kustoPotential re-named sdelete usage (ASIM Version) kustoSdelete deployed via GPO and run recursively kustoSdelete deployed via GPO and run recursively (ASIM Version)	5	13
`CommandLine`	`contains`	`-s` kustoPotential re-named sdelete usage kustoPotential re-named sdelete usage (ASIM Version) kustoSdelete deployed via GPO and run recursively kustoSdelete deployed via GPO and run recursively (ASIM Version)	4	10
`EventType`	`eq`	`creation` elasticPotential Ransomware Behavior - Note Files by System elasticPotential Ransomware Note File elasticPotential Ransomware Note File Dropped via SMB elasticPotential Ransomware Note File via SMB	4	58
`Operation`	`eq`	`harddelete` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`m365::Folder.Path`	`in`	`\\recoverable items\\deletions` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`m365::Folder.Path`	`in`	`\\sent items` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`process_id`	`eq`	`4` elasticPotential Ransomware Behavior - Note Files by System elasticPotential Ransomware Note File Dropped via SMB elasticPotential Ransomware Note File via SMB elasticSuspicious File Renamed via SMB	4	19
`sourcetype`	`in`	`ms:o365:reporting:messagetrace` splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send Attachments Excessive Volume	4	4
`sourcetype`	`in`	`o365:reporting:messagetrace` splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send Attachments Excessive Volume	4	4
`EventID`	`eq`	`4688` splunkCipher.exe Execution (Windows Event Log) kustoPotential re-named sdelete usage kustoSdelete deployed via GPO and run recursively	3	317
`EventID`	`in`	`23` splunkExcessive File Deletion In WinDefender Folder splunkWindows Data Destruction Recursive Exec Files Deletion splunkWindows High File Deletion Frequency	3	10
`EventID`	`in`	`26` splunkExcessive File Deletion In WinDefender Folder splunkWindows Data Destruction Recursive Exec Files Deletion splunkWindows High File Deletion Frequency	3	10
`OriginalFileName`	`eq`	`sdelete.exe` sigmaPotential File Overwrite Via Sysinternals SDelete sigmaRenamed Sysinternals Sdelete Execution splunkSdelete Application Execution	3	4
`Provider_Name`	`eq`	`rds.amazonaws.com` elasticAWS RDS DB Instance or Cluster Deleted elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled elasticAWS RDS Snapshot Deleted	3	9
`TargetFilename`	`starts_with`	`c:\users\` elasticPotential Ransomware Note File Dropped via SMB elasticPotential Ransomware Note File via SMB elasticSuspicious File Renamed via SMB	3	13
`aws::eventName`	`eq`	`PutBucketVersioning` pantherAWS S3 Security Control Disabling pantherS3 Bucket Versioning Suspended pantherS3 MFA Delete Disabled	3	3
`event.type`	`eq`	`change` elasticHigh Number of Closed Pull Requests by User elasticHigh Number of Protected Branch Force Pushes by User elasticPotential Secure File Deletion via SDelete Utility	3	94
`event_action`	`in`	`created` splunkCommon Ransomware Extensions splunkCommon Ransomware Notes splunkWindows File Without Extension In Critical Folder	3	7
`event_action`	`in`	`modified` splunkCommon Ransomware Extensions splunkCommon Ransomware Notes splunkWindows File Without Extension In Critical Folder	3	7

Exclusions (264 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`CommandLine`	`contains`	`sdelete` kustoPotential re-named sdelete usage kustoPotential re-named sdelete usage (ASIM Version)	2
`CommandLine`	`contains`	`-c` sigmaPotential File Overwrite Via Sysinternals SDelete	1
`CommandLine`	`contains`	`-h` sigmaPotential File Overwrite Via Sysinternals SDelete	1
`CommandLine`	`contains`	`-z` sigmaPotential File Overwrite Via Sysinternals SDelete	1
`CommandLine`	`contains`	`/?` sigmaPotential File Overwrite Via Sysinternals SDelete	1
`aws::sourceIPAddress`	`eq`	`backup.amazonaws.com` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS RDS Snapshot Deleted	2
`aws::userAgent`	`eq`	`aws internal` elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion	2
`process.code_signature.trusted`	`eq`	`true` elasticPotential Data wiping Attack Behavior elasticThird-party Backup Files Deleted via Unexpected Process	2
`Image`	`ends_with`	`\sdelete.exe` sigmaRenamed Sysinternals Sdelete Execution	1
`Image`	`ends_with`	`\sdelete64.exe` sigmaRenamed Sysinternals Sdelete Execution	1
`Image`	`ends_with`	`\sdelete64a.exe` sigmaRenamed Sysinternals Sdelete Execution	1
`Image`	`eq`	`?:\program files\tortoisesvn\bin\tsvncache.exe` elasticPotential Ransomware Note File	1
`Image`	`eq`	`?:\windows\system32\svchost.exe` elasticPotential Ransomware Note File	1
`Image`	`eq`	`c:\prowin22\32bit\proseriesbackgroundupdater.exe` elasticPotential Ransomware Note File	1
`Image`	`eq`	`c:\windows\system32\msiexec.exe` elasticPotential Data wiping Attack Behavior	1

Data Destruction `T1485`

Events covered

Authoring guide

Fields filtered most (202 distinct)

Top indicator values (699 distinct)

Exclusions (264 distinct)

Rules under this technique

Sigma 21 rules

Elastic 46 rules

Splunk 40 rules

Kusto 39 rules

YARA-L 7 rules

Panther 41 rules

Data Destruction T1485

Events covered

Authoring guide

Fields filtered most (202 distinct)

Top indicator values (699 distinct)

Exclusions (264 distinct)

Rules under this technique

Sigma 21 rules

Elastic 46 rules

Splunk 40 rules

Kusto 39 rules

YARA-L 7 rules

Panther 41 rules

Data Destruction `T1485`