attack.t1485 | Detection.FYI

MSSQL Destructive Query

Jun 11, 2025 · attack.exfiltration attack.impact attack.t1485 ·
Share on:

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

Read More
Azure Container Registry Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects when a Container Registry is created or deleted.

Read More
Azure Kubernetes Cluster Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Read More
Azure Kubernetes Network Policy Change

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More
Azure Kubernetes Secret or Config Object Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Read More
Azure Kubernetes Sensitive Role Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Read More
Azure Kubernetes Service Account Modified or Deleted

Jun 4, 2025 · attack.impact attack.t1531 attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a service account is modified or deleted.

Read More
Potential BlackByte Ransomware Activity

Jan 30, 2025 · attack.execution attack.defense-evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 detection.emerging-threats ·
Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Read More
Potential Secure Deletion with SDelete

Dec 14, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·
Share on:

Detects files that have extensions commonly seen while SDelete is used to wipe files.

Read More
AWS EFS Fileshare Mount Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Read More
AWS EKS Cluster Created or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Identifies when an EKS cluster is created or deleted.

Read More
Azure Device or Configuration Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 attack.t1565.001 ·
Share on:

Identifies when a device or device configuration in azure is modified or deleted.

Read More
DD File Overwrite

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects potential overwriting and deletion of a file using DD.

Read More
Deleted Data Overwritten Via Cipher.EXE

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Read More
Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·
Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

Read More
Microsoft 365 - Unusual Volume of File Deletion

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Read More
Overwriting the File with Dev Zero or Null

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects overwriting (effectively wiping/deleting) of a file.

Read More
Potential File Overwrite Via Sysinternals SDelete

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects the use of SDelete to erase a file not the free space

Read More
Renamed Sysinternals Sdelete Execution

Aug 12, 2024 · attack.impact attack.t1485 ·
Share on:

Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Read More