tfMITRE ATT&CK sub-technique

Lifecycle-Triggered Deletion T1485.001

Tactic: Impact
Platform: IaaS
Version: 1.1
Created: 25 September 2024
Last modified: 15 April 2025

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Offense vs defense T1485.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2

first rule: 2022 Q3

Lifecycle-Triggered Deletion detection strategy DET0041

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Lifecycle Policy Modifications for Triggered Deletion in IaaS Cloud Storage

Enterprise

1 platform

AN0117 · IaaS

Adversary with write access to storage modifies lifecycle policies (e.g., via PutBucketLifecycle) to schedule rapid object deletion across one or more storage buckets. This is often used to trigger impact (destruction), remove logs (defense evasion), or force extortion (ransomware).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage ModificationDC0023	AWS:CloudTrail	PutBucketLifecycle, PutLifecycleConfiguration, SetBucketLifecycle, storage.buckets.update

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LifecycleExpirationDays	Policy values setting Expiration in fewer than N days (e.g., 0–1) are highly suspicious.
TargetBucket	Filter by bucket types (e.g., log storage, production DB snapshots) to prioritize detection.
Principal	Correlate rare or anomalous IAM principals making destructive lifecycle changes.
TimeWindow	Link lifecycle policy change with API activity suggesting staged deletion or extortion attempt.

Data BackupM1053

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

User Account ManagementM1018

In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.

Lifecycle-Triggered Deletion detections T1485.001

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs