Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.[4][5] In some cases politically oriented image files have been used to overwrite data.[2][3][4]

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, Credential Dumping, and Windows Admin Shares.[1][2][3][4][6]

ID: T1485

Tactic: Impact

Platform:  Linux, macOS, Windows

Permissions Required:  User, Administrator, root, SYSTEM

Data Sources:  File monitoring, Process command-line parameters, Process monitoring

Impact Type:  Availability

Version: 1.0

Examples

NameDescription
APT38

APT38 has used a custom secure delete function to make deleted files unrecoverable.[7]

BlackEnergy

BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.[8]

Kazuar

Kazuar can overwrite files with random data before deleting them.[9]

Lazarus Group

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.[10]

Olympic Destroyer

Olympic Destroyer overwrites files locally and on remote shares. It deletes and disables system recovery files and features such as the Windows backup catalog and Windows Automatic Repair. [6]

PowerDuke

PowerDuke has a command to write random data across a file and delete it.[11]

Proxysvc

Proxysvc can overwrite files indicated by the attacker before deleting them.[12]

RawDisk

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.[3][5]

SDelete

SDelete deletes data in a way that makes it unrecoverable.[13]

Shamoon

Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.[1][2][3][5]

Mitigation

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.[14] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Identify potentially malicious software and audit and/or block it by using whitelisting[15] tools, like AppLocker,[16][17] or Software Restriction Policies[18] where appropriate.[19]

Detection

Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as SDelete. Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under C:\Windows\System32\.

References