THREATNOIR
Subscribe
MITRE ATT&CK · T1485

Data Destruction

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers destroy data and files on systems, sometimes overwriting them so they cannot be recovered, to disrupt operations. Wiper malware and destructive cloud actions fall here. This serves the Impact tactic.

How to defend. Keep offline or immutable backups and test restores. Limit privileged access and protect administrative tools, cloud management consoles and backup systems with strong authentication. Enable deletion protection features on cloud resources where available. Use separate administrative accounts for backup and cloud management, and require approval for bulk deletion where tools allow it. Keep an incident playbook for destructive attacks, since recovery speed matters most.

Signs to look for. Look for mass deletions, overwriting tools running, deletion of cloud resources or storage, and disabling of backups. A common gap is backup systems reachable with the same credentials attackers have already stolen.

Open the technique on MITRE ATT&CK
The official text
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as `del` and `rm` often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.