MITRE ATT&CK technique
Data Destruction detection rulesT1485
Data Destruction (T1485) is a MITRE ATT&CK technique in the Impact tactic. This page lists the 20 community-maintained Sigma detection rules in the library mapped to T1485 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target azure, windows, aws.
Fsutil Suspicious Invocation
highDetects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).
windows · process_creation
Potential BlackByte Ransomware Activity
highDetects command line patterns used by BlackByte ransomware in different operations
windows · process_creation
Potential File Overwrite Via Sysinternals SDelete
highDetects the use of SDelete to erase a file not the free space
windows · process_creation
Renamed Sysinternals Sdelete Execution
highDetects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)
windows · process_creation
AWS EFS Fileshare Mount Modified or Deleted
mediumDetects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
aws
Azure Device or Configuration Modified or Deleted
mediumIdentifies when a device or device configuration in azure is modified or deleted.
azure
Azure Kubernetes Network Policy Change
mediumIdentifies when a Azure Kubernetes network policy is modified or deleted.
azure
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
mediumDetects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
azure
Azure Kubernetes Secret or Config Object Access
mediumIdentifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
azure
Azure Kubernetes Sensitive Role Access
mediumIdentifies when ClusterRoles/Roles are being modified or deleted.
azure
Azure Kubernetes Service Account Modified or Deleted
mediumIdentifies when a service account is modified or deleted.
azure
Deleted Data Overwritten Via Cipher.EXE
mediumDetects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
windows · process_creation
Microsoft 365 - Unusual Volume of File Deletion
mediumDetects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
m365
MSSQL Destructive Query
mediumDetects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
windows
Potential Secure Deletion with SDelete
mediumDetects files that have extensions commonly seen while SDelete is used to wipe files.
windows
AWS EKS Cluster Created or Deleted
lowIdentifies when an EKS cluster is created or deleted.
aws
Azure Container Registry Created or Deleted
lowDetects when a Container Registry is created or deleted.
azure
Azure Kubernetes Cluster Created or Deleted
lowDetects when a Azure Kubernetes Cluster is created or deleted.
azure
DD File Overwrite
lowDetects potential overwriting and deletion of a file using DD.
linux · process_creation
Overwriting the File with Dev Zero or Null
lowDetects overwriting (effectively wiping/deleting) of a file.
linux