ShinyHuntersG1057 ↗
Has executed the DeleteBucket API call to delete buckets.1
tfMITRE ATT&CK technique
Data Destruction T1485
- Tactic
- Impact
- Platforms
- Containers, ESXi, IaaS, Linux, macOS, Windows
- Version
- 1.4
- Created
- 14 March 2019
- Last modified
- 12 May 2026
- Contributors
- Brent Murphy, Elastic; David French, Elastic; Syed Ummar Farooqh, McAfee; Prasad Somasamudram, McAfee; Sekhar Sarukkai, McAfee; Varonis Threat Labs; Joey Lei
Sub-techniques 158 rules across the family · 56 mapped directly to T1485 · 1 of 1 carry rules
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.30
Tools & malwareTop 12%
Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.56
Detection rulesTop 3%
Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.Data Destruction MITRE reference T1485
Top 21%of all ATT&CK techniques for number of groups
8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
TeamPCPG1056 ↗
Has deployed privileged DaemonSets to delete files on Kubernetes clusters and has executed recursive file deletions on non-containerized hosts.1
VOID MANTICOREG1055 ↗
Has conducted data wiping attacks on compromised systems.1234 VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.13
Storm-0501G1053 ↗
Has destroyed data and backup files.1
LAPSUS$G1004 ↗
Has deleted the target's systems and resources both on-premises and in the cloud.12
APT38G0082 ↗
Has used a custom secure delete function to make deleted files unrecoverable.1
All 8 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries utilized wiper malware to overwrite files using a 16-byte buffer that fully overwrites files 16 bytes or smaller or partially overwrites files greater than 16 bytes to speed up the process.12
2022 Ukraine Electric Power AttackC0034 ↗
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.1
All 2 campaigns for this technique
30 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has wiped data on devices that fall within specified parameters to include those that resolve to specific geolocations including Iran and Israel.12 Mini Shai-Hulud has also implemented a dead-man’s switch that wipes the victims home directory if the operator revokes a GitHub token created by the adversary. 3
CanisterWormS9042 ↗
Has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.12
LazyWiperS9039 ↗
Has overwritten files with pseudorandom 32‑byte sequences written at 16‑byte intervals making the file unrecoverable.1
DynoWiperS9038 ↗
Has overwritten files with 16-byte sequences of random data generated by the Mersenne Twister algorithm using the Microsoft Windows native CreateFileW() function to open the file and the SetFilePointerEx() and WriteFile() functions to overwrite the file.1 Additionally, versions of DynoWiper can also delete files using the DeleteFileW API.2
SameCoinS9030 ↗
Can overwrite designated files on targeted systems with random bytes.1
Shai-HuludS9008 ↗
Has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder.12 Shai-Hulud has also utilized the shred command on Linux devices.3
All 30 software entries for this technique · 6 newest in this preview
Offense vs defense T1485
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 36
first rule: 2017 Q2 · 2 of 2 campaigns plottedData Destruction detection strategy DET0146
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns
6 platforms
AN0411 · Windows
Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File DeletionDC0040 | WinEventLog:Sysmon | EventCode=23 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetFilename | Filter file deletion activity to sensitive locations (e.g., %System32%, Documents, DB paths). |
| ProcessCommandLine | Tune for aggressive overwrite flags (e.g., /w, /q, /s) or temp file overwrites. |
| VolumeThreshold | Threshold of unique file deletions or modifications within time window. |
| TimeWindow | Correlate rapid file delete/overwrite behavior from same process/user. |
AN0412 · Linux
Massive recursive deletions or overwrites via rm -rf, shred, dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File DeletionDC0040 | auditd:SYSCALL | unlink, unlinkat, openat, write |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutablePath | Focus on binaries like shred, dd, wipe, custom wipers, or bash execution chains. |
| DeletedPathPattern | Tune for critical mount points or home/data directories. |
| SyscallBurstRate | Rate of unlink/unlinkat syscalls to indicate mass deletion in a short period. |
AN0413 · macOS
Destruction via rm -rf, overwrite with dd or srm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process TerminationDC0033 | macos:unifiedlog | process.*exit.*code |
| File DeletionDC0040 | macos:unifiedlog | exec rm -rf|dd if=/dev|srm|file unlink |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandPattern | Focus on high-risk patterns in temporary directories or key system paths. |
| EntropyChangeRate | Optional anomaly detection on overwritten files with high-entropy payloads. |
AN0414 · IaaS
Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with Delete* or TerminateInstances.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage DeletionDC0022 | AWS:CloudTrail | DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| OperationType | Correlate multiple destructive API calls over short intervals. |
| UserAgent | Flag non-console/API clients initiating destructive behavior. |
| RegionScope | Observe whether deletions span multiple regions or org accounts. |
AN0415 · ESXi
Adversary destroys virtual disks (VMDK), images, or VMs by invoking vim-cmd, deleting datastore contents, or purging snapshots.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Volume DeletionDC0098 | esxi:vmkernel | file delete|datastore purge |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DatastorePath | Targeted deletion of critical VMDKs or VM configuration files. |
| InitiatingUser | Detect deletions from users outside normal maintenance windows. |
AN0416 · Containers
Container process executes destructive file operations inside volume mounts or host paths. Includes rm -rf /mnt/volumes/, container breakout followed by host deletion attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File DeletionDC0040 | auditd:SYSCALL | unlink, unlinkat, rmdir |
| Command ExecutionDC0064 | docker:events | container exec rm|container stop --force |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MountPoint | Identify when deletions occur inside persistent or shared volume paths. |
| ContainerImage | Correlate destructive behavior with unknown or untrusted container sources. |
Data BackupM1053
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data destruction in cloud environments by ensuring that only authenticated actions can irreversibly delete storage or machine images.
In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.
Tests5Executorssh 2 · cmd 2 · PowerShell 1Need elevation0 of 5Have prerequisites3Have cleanup1Platformswindows, linux, macos, iaas:gcp
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Windows - Overwrite file with SysInternals SDelete | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||
Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in the powershell session along with other information about the file that was deleted. Input arguments
Attack command if (-not (Test-Path "#{file_to_delete}")) { New-Item "#{file_to_delete}" -Force }
& "#{sdelete_exe}" -accepteula "#{file_to_delete}"
Prerequisite Secure delete tool from SysInternals must exist on disk at specified location (#{sdelete_exe}) Check if (Test-Path "#{sdelete_exe}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://download.sysinternals.com/files/SDelete.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\SDelete.zip" Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\SDelete.zip" "PathToAtomicsFolder\..\ExternalPayloads\Sdelete" -Force Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\SDelete.zip" -Force GUID423f35e1-8d07-4709-ab10-8a8b5fdd710c | ||||||||||||||||||||||||||||
| 02 | FreeBSD/macOS/Linux - Overwrite file with DD | linux, macos | sh | — | — | — | ||||||||||||||||||||||
Overwrites and deletes a file using DD. To stop the test, break the command with CTRL/CMD+C. Input arguments
Attack command dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk '{print $5}') iflag=count_bytes
GUID6fc91c87-39cc-45e7-9fb8-b2737b6fba63 | ||||||||||||||||||||||||||||
| 03 | Overwrite deleted data on C drive | windows | cmd | — | — | — | ||||||||||||||||||||||
RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover. This process is very slow and test execution may timeout. https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4 Attack command cipher.exe /w:C: GUID22043a19-a911-47e2-a9c6-19acaf4b568b | ||||||||||||||||||||||||||||
| 04 | GCP - Delete Bucket | iaas:gcp | sh | — | 4 | Yes | ||||||||||||||||||||||
This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team. Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations. This atomic will create a bucket then delete the bucket. Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml Input arguments
Attack command gcloud config set project #{project_id}
gcloud storage buckets delete gs://#{bucket_name}
Cleanup command cd "$PathToAtomicsFolder/T1485/src/T1485-4/" terraform state rm google_storage_bucket.bucket terraform destroy -auto-approve Prerequisite Requires gcloud Check if [ -x "$(command -v gcloud)" ]; then exit 0; else exit 1; fi; Satisfy echo "Please Install Google Cloud SDK before running this atomic test : https://cloud.google.com/sdk/docs/install" Prerequisite Check if user is logged in Check gcloud config get-value account Satisfy gcloud auth login --no-launch-browser Prerequisite Check if terraform is installed. Check terraform version Satisfy echo Please install the terraform. Prerequisite Create dependency resources using terraform Check stat "$PathToAtomicsFolder/T1485/src/T1485-4/terraform.tfstate" Satisfy cd "$PathToAtomicsFolder/T1485/src/T1485-4/" terraform init terraform apply -auto-approve GUID55ccf288-1520-4aba-9049-b11f990dffa1 | ||||||||||||||||||||||||||||
| 05 | ESXi - Delete VM Snapshots | windows | cmd | — | 1 | — | ||||||||||||||||||||||
Deletes all snapshots for all Virtual Machines on an ESXi Host Reference Input arguments
Attack command echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/snapshot.removeall $i & done"
Prerequisite Check if we have plink Check if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"
GUIDb41bf741-319a-4b7f-88ad-5bd3e327404a | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition