attack.t1485

Potential Secure Deletion with SDelete

Dec 14, 2024 · attack.impact attack.defense-evasion attack.t1070.004 attack.t1027.005 attack.t1485 attack.t1553.002 attack.s0195 ·

Share on:

Detects files that have extensions commonly seen while SDelete is used to wipe files.

AWS EFS Fileshare Mount Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

AWS EKS Cluster Created or Deleted

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Identifies when an EKS cluster is created or deleted.

Azure Device or Configuration Modified or Deleted

Aug 12, 2024 · attack.impact attack.t1485 attack.t1565.001 ·

Share on:

Identifies when a device or device configuration in azure is modified or deleted.

DD File Overwrite

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects potential overwriting and deletion of a file using DD.

Deleted Data Overwritten Via Cipher.EXE

Aug 12, 2024 · attack.impact attack.t1485 ·

Share on:

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Fsutil Suspicious Invocation

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).