自动化接入 · API / MCP EN

技术说明 · T1485

Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares. In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.

ATT&CK T1485 platforms — 状态 有效 版本 20.1

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.123456 Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.78 In some cases politically oriented image files have been used to overwrite data.91011 To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.1213141516 In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.1718 Similarly, they may delete virtual machines from on-prem virtualized environments.

  1. Symantec Shamoon 2012
  2. FireEye Shamoon Nov 2016
  3. Palo Alto Shamoon Nov 2016
  4. Kaspersky StoneDrill 2017
  5. Unit 42 Shamoon3 2018
  6. Talos Olympic Destroyer 2018
  7. Kaspersky StoneDrill 2017
  8. Unit 42 Shamoon3 2018
  9. FireEye Shamoon Nov 2016
  10. Palo Alto Shamoon Nov 2016
  11. Kaspersky StoneDrill 2017
  12. Symantec Shamoon 2012
  13. FireEye Shamoon Nov 2016
  14. Palo Alto Shamoon Nov 2016
  15. Kaspersky StoneDrill 2017
  16. Talos Olympic Destroyer 2018
  17. Data Destruction - Threat Post
  18. DOJ - Cisco Insider

使用该技术的组织

组织名称国家
grp_g1056TeamPCP—
grp_g0032Lazarus GroupDPRK
grp_g1057ShinyHunters—
grp_g1053Storm-0501—
grp_g1004LAPSUS$—
grp_g1055VOID MANTICORE—
grp_g0082APT38DPRK
grp_g0034Sandworm TeamRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。