Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0146 — Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns
DET0146

Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns

6 analytic(s) · 1 technique(s) detected

Analytics

6
AN0411 Analytic 0411
Windows

Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=11 WinEventLog:Sysmon EventCode=23
[TargetFilename] Filter file deletion activity to sensitive locations (e.g., %System32%, Documents, DB paths).
[ProcessCommandLine] Tune for aggressive overwrite flags (e.g., /w, /q, /s) or temp file overwrites.
[VolumeThreshold] Threshold of unique file deletions or modifications within time window.
[TimeWindow] Correlate rapid file delete/overwrite behavior from same process/user.
AN0412 Analytic 0412
Linux

Massive recursive deletions or overwrites via `rm -rf`, `shred`, `dd`, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.

auditd:SYSCALL unlink, unlinkat, openat, write auditd:SYSCALL execve
[ExecutablePath] Focus on binaries like shred, dd, wipe, custom wipers, or bash execution chains.
[DeletedPathPattern] Tune for critical mount points or home/data directories.
[SyscallBurstRate] Rate of unlink/unlinkat syscalls to indicate mass deletion in a short period.
AN0413 Analytic 0413
macOS

Destruction via `rm -rf`, overwrite with `dd` or `srm`, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.

macos:unifiedlog exec rm -rf|dd if=/dev|srm|file unlink macos:unifiedlog process.*exit.*code
[CommandPattern] Focus on high-risk patterns in temporary directories or key system paths.
[EntropyChangeRate] Optional anomaly detection on overwritten files with high-entropy payloads.
AN0414 Analytic 0414
IaaS

Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with `Delete*` or `TerminateInstances`.

AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances
[OperationType] Correlate multiple destructive API calls over short intervals.
[UserAgent] Flag non-console/API clients initiating destructive behavior.
[RegionScope] Observe whether deletions span multiple regions or org accounts.
AN0415 Analytic 0415
ESXi

Adversary destroys virtual disks (VMDK), images, or VMs by invoking `vim-cmd`, deleting datastore contents, or purging snapshots.

esxi:vmkernel file delete|datastore purge
[DatastorePath] Targeted deletion of critical VMDKs or VM configuration files.
[InitiatingUser] Detect deletions from users outside normal maintenance windows.
AN0416 Analytic 0416
Containers

Container process executes destructive file operations inside volume mounts or host paths. Includes `rm -rf /mnt/volumes/`, container breakout followed by host deletion attempts.

auditd:SYSCALL unlink, unlinkat, rmdir docker:events container exec rm|container stop --force
[MountPoint] Identify when deletions occur inside persistent or shared volume paths.
[ContainerImage] Correlate destructive behavior with unknown or untrusted container sources.

Detected Techniques

1

Details

MITRE ID
DET0146
STIX ID
x-mitre-detection-strategy--c54fdf95-c7ac-4ca4-bd99-273e56da20a5
Analytics
6
Techniques Detected
1
By Tactic
Impact
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.