Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.[7][8] In some cases politically oriented image files have been used to overwrite data.[9][10][7]
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[11][12][13][14][15]
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.[16][17] Similarly, they may delete virtual machines from on-prem virtualized environments.
Top 21%of all ATT&CK techniques for number of groups
8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has conducted data wiping attacks on compromised systems.1234VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.13
During the 2025 Poland Wiper Attacks, the adversaries utilized wiper malware to overwrite files using a 16-byte buffer that fully overwrites files 16 bytes or smaller or partially overwrites files greater than 16 bytes to speed up the process.12
30 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has wiped data on devices that fall within specified parameters to include those that resolve to specific geolocations including Iran and Israel.12Mini Shai-Hulud has also implemented a dead-man’s switch that wipes the victims home directory if the operator revokes a GitHub token created by the adversary. 3
Has overwritten files with 16-byte sequences of random data generated by the Mersenne Twister algorithm using the Microsoft Windows native CreateFileW() function to open the file and the SetFilePointerEx() and WriteFile() functions to overwrite the file.1 Additionally, versions of DynoWiper can also delete files using the DeleteFileW API.2
Has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder.12Shai-Hulud has also utilized the shred command on Linux devices.3
created 2026-04-09MALWARE
All 30 software entries for this technique · 6 newest in this preview
Offense vs defense T1485
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.
Range
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns
Enterprise
6 platforms
AN0411 · Windows
Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TargetFilename
Filter file deletion activity to sensitive locations (e.g., %System32%, Documents, DB paths).
ProcessCommandLine
Tune for aggressive overwrite flags (e.g., /w, /q, /s) or temp file overwrites.
VolumeThreshold
Threshold of unique file deletions or modifications within time window.
TimeWindow
Correlate rapid file delete/overwrite behavior from same process/user.
AN0412 · Linux
Massive recursive deletions or overwrites via rm -rf, shred, dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ExecutablePath
Focus on binaries like shred, dd, wipe, custom wipers, or bash execution chains.
DeletedPathPattern
Tune for critical mount points or home/data directories.
SyscallBurstRate
Rate of unlink/unlinkat syscalls to indicate mass deletion in a short period.
AN0413 · macOS
Destruction via rm -rf, overwrite with dd or srm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CommandPattern
Focus on high-risk patterns in temporary directories or key system paths.
EntropyChangeRate
Optional anomaly detection on overwritten files with high-entropy payloads.
AN0414 · IaaS
Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with Delete* or TerminateInstances.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
DatastorePath
Targeted deletion of critical VMDKs or VM configuration files.
InitiatingUser
Detect deletions from users outside normal maintenance windows.
AN0416 · Containers
Container process executes destructive file operations inside volume mounts or host paths. Includes rm -rf /mnt/volumes/, container breakout followed by host deletion attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data destruction in cloud environments by ensuring that only authenticated actions can irreversibly delete storage or machine images.
In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.
Windows - Overwrite file with SysInternals SDelete
windows
powershell
—
1
—
Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in
the powershell session along with other information about the file that was deleted.
RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover.
This process is very slow and test execution may timeout.
https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware
https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4
Attack Commandsrun with command_prompt
cipher.exe /w:C:
GUID321fd25e-0007-417f-adec-33232252be19
04
GCP - Delete Bucket
iaas:gcp
sh
—
4
Yes
This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team.
Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.
This atomic will create a bucket then delete the bucket.
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml
Inputs
Name
Description
Type
Default Value
project_id
ID of the GCP Project you to execute the command against.
string
atomic-test-1
bucket_name
The name of the bucket to delete.
string
atomic-red-team-bucket
Attack Commandsrun with sh
gcloud config set project #{project_id}
gcloud storage buckets delete gs://#{bucket_name}
Cleanup Commands
cd "$PathToAtomicsFolder/T1485/src/T1485-4/"
terraform state rm google_storage_bucket.bucket
terraform destroy -auto-approve
Dependenciesrun with sh
Description
Requires gcloud
Check Prereq Commands
if [ -x "$(command -v gcloud)" ]; then exit 0; else exit 1; fi;
Get Prereq Commands
echo "Please Install Google Cloud SDK before running this atomic test : https://cloud.google.com/sdk/docs/install"
Description
Check if user is logged in
Check Prereq Commands
gcloud config get-value account
Get Prereq Commands
gcloud auth login --no-launch-browser
Description
Check if terraform is installed.
Check Prereq Commands
terraform version
Get Prereq Commands
echo Please install the terraform.
Description
Create dependency resources using terraform
Check Prereq Commands
stat "$PathToAtomicsFolder/T1485/src/T1485-4/terraform.tfstate"
Get Prereq Commands
cd "$PathToAtomicsFolder/T1485/src/T1485-4/"
terraform init
terraform apply -auto-approve
GUID4ac71389-40f4-448a-b73f-754346b3f928
05
ESXi - Delete VM Snapshots
windows
command_prompt
—
1
—
Deletes all snapshots for all Virtual Machines on an ESXi Host
Reference
Inputs
Name
Description
Type
Default Value
vm_host
Specify the host name or IP of the ESXi server.
string
atomic.local
vm_pass
Specify the privileged user's password.
string
password
vm_user
Specify the privilege user account on the ESXi server.
string
root
plink_file
Path to Plink
path
PathToAtomicsFolder\..\ExternalPayloads\plink.exe
Attack Commandsrun with command_prompt
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/snapshot.removeall $i & done"
Dependenciesrun with powershell
Description
Check if we have plink
Check Prereq Commands
if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
Top 3%of all ATT&CK techniques for number of rules
Showing 1-50 of 56 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)
The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. (...)
The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. (...)
The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. (...)
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. (...)
The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). (...)
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). (...)
The following analytic detects the execution of the sdelete.exe application, a Sysinternals tool often used by adversaries to securely delete files and remove forensic evidence from a targeted host. (...)
This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths. (...)