ATT&CK Reference
Portfolio

TA0040 · IMPACT

Data Destruction

T1485Windows · IaaS · Linux · macOS · Containers · ESXiattack.mitre.org

Wipers and secure-delete operations that destroy data with no intent of recovery.

Detect it with

Raw disk writes by unexpected processes; SDelete-style patterns across many hosts at once.

Why it matters on shift

Data Destruction is one of the concrete ways adversaries achieve impact. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After impact, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.

1 sub-techniques

How it shows up in practice

  1. T1485.001

    Lifecycle-Triggered Deletion

    Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Kill-chain context

← beforeExfiltrationImpact