Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as
rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..
In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.
APT38 has used a custom secure delete function to make deleted files unrecoverable.
BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.
CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.
Diavol can delete specified files from a targeted system.
Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.
HermeticWiper can recursively wipe folders and files in
Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.
Kazuar can overwrite files with random data before deleting them.
KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.
LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.
Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.
Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.
Olympic Destroyer overwrites files locally and on remote shares.
PowerDuke has a command to write random data across a file and delete it.
Proxysvc can overwrite files indicated by the attacker before deleting them.
RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.
REvil has the capability to destroy files and folders.
Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces. 
SDelete deletes data in a way that makes it unrecoverable.
Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.
StoneDrill has a disk wiper module that targets files other than those in the Windows directory.
WhisperGate can corrupt files by overwriting the first 1 MB with
Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
|ID||Data Source||Data Component||Detects|
|DS0010||Cloud Storage||Cloud Storage Deletion||
Monitor for unexpected deletion of a cloud storage infrastructure, such as the
Monitor executed commands and arguments for binaries that could be involved in data destruction activity, such as SDelete.
Monitor for unexpected deletion to a file (ex: Sysmon EID 23)
Monitor for changes made to a large quantity of files for unexpected modifications in user directories and under C:\Windows\System32.
Monitor for unexpected deletion of a virtual machine image (ex: Azure Compute Service Images DELETE)
Monitor for unexpected deletion of an instance (ex: instance.delete within GCP Audit Logs)
Monitor for newly executed processes of binaries that could be involved in data destruction activity, such as SDelete.
Monitor for unexpected deletion of a snapshot (ex: AWS delete-snapshot)
Monitor for unexpected deletion of a cloud volume (ex: AWS delete-volume)