T1485_data-destruction

T1485 Data Destruction

High-Level Description

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.

Kill Chain Phase

• Impact (TA0040)

Platforms: Containers, ESXi, IaaS, Linux, macOS, Windows

What to Check

• Identify if Data Destruction technique is applicable to target environment
• Check Containers systems for indicators of Data Destruction
• Check ESXi systems for indicators of Data Destruction
• Check IaaS systems for indicators of Data Destruction
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Windows - Overwrite file with SysInternals SDelete

Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in the powershell session along with other information about the file that was deleted.

Supported Platforms: windows

if (-not (Test-Path "#{file_to_delete}")) { New-Item "#{file_to_delete}" -Force }
& "#{sdelete_exe}" -accepteula "#{file_to_delete}"

Dependencies:

• Secure delete tool from SysInternals must exist on disk at specified location (#{sdelete_exe})

Atomic Test 2: FreeBSD/macOS/Linux - Overwrite file with DD

Overwrites and deletes a file using DD. To stop the test, break the command with CTRL/CMD+C.

Supported Platforms: linux, macos

dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk '{print $5}') iflag=count_bytes

Atomic Test 3: Overwrite deleted data on C drive

RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover. This process is very slow and test execution may timeout. https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4

Supported Platforms: windows

cipher.exe /w:C:

Atomic Test 5: ESXi - Delete VM Snapshots

Deletes all snapshots for all Virtual Machines on an ESXi Host Reference

Supported Platforms: windows

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/snapshot.removeall $i & done"

Dependencies:

• Check if we have plink

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Data Destruction by examining the target platforms (Containers, ESXi, IaaS).

2. Assess Existing Defenses: Review whether mitigations for T1485 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1032 Multi-factor Authentication

Implement multi-factor authentication (MFA) delete for cloud storage resources, such as AWS S3 buckets, to prevent unauthorized deletion of critical data and infrastructure. MFA delete requires additional authentication steps, making it significantly more difficult for adversaries to destroy data without proper credentials. This additional security layer helps protect against the impact of data destruction in cloud environments by ensuring that only authenticated actions can irreversibly delete storage or machine images.

M1053 Data Backup

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

M1018 User Account Management

In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.

Detection

Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns

Risk Assessment

CWE Categories

References

• DOJ - Cisco Insider
• Unit 42 Shamoon3 2018
• Palo Alto Shamoon Nov 2016
• FireEye Shamoon Nov 2016
• Kaspersky StoneDrill 2017
• Talos Olympic Destroyer 2018
• Data Destruction - Threat Post
• Symantec Shamoon 2012
• Atomic Red Team - T1485
• MITRE ATT&CK - T1485