CyberStack

MITRE ATT&CK / Techniques / T1485

Data Destruction

ID
T1485
Tactics
TA0040 Impact
Platforms
Containers, ESXi, IaaS, Linux, macOS, Windows
Data sources
Process Creation, File Creation, File Deletion, Process Termination, Cloud Storage Deletion, Volume Deletion, Command Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[2][3][4][5][6][7] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.[5][6] In some cases politically oriented image files have been used to overwrite data.[3][4][5]

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[2][3][4][5][7].

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.[8][9] Similarly, they may delete virtual machines from on-prem virtualized environments.

Sub-techniques (1)

Detection

Mitigations (3)

M1018 User Account Management

In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.

M1032 Multi-factor Authentication

Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data destruction in cloud environments by ensuring that only authenticated actions can irreversibly delete storage or machine images.

M1053 Data Backup

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.[1] Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Groups (8)

Software (30)

References

  1. Ready.gov IT DRP
  2. Symantec Shamoon 2012
  3. FireEye Shamoon Nov 2016
  4. Palo Alto Shamoon Nov 2016
  5. Kaspersky StoneDrill 2017
  6. Unit 42 Shamoon3 2018
  7. Talos Olympic Destroyer 2018
  8. Data Destruction - Threat Post
  9. DOJ - Cisco Insider