Skip to content

Latest commit

 

History

History
102 lines (69 loc) · 4.9 KB

T1485.md

File metadata and controls

102 lines (69 loc) · 4.9 KB
Raw

T1485 - Data Destruction

Description from ATT&CK

Adversaries may destroy data data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, Credential Dumping, and Windows Admin Shares.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)

Atomic Tests


Atomic Test #1 - Windows - Delete Volume Shadow Copies

Deletes Windows Volume Shadow Copies. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.

Supported Platforms: Windows

Run it with command_prompt!

vssadmin.exe delete shadows /all /quiet


Atomic Test #2 - Windows - Delete Windows Backup Catalog

Deletes Windows Backup Catalog. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.

Supported Platforms: Windows

Run it with command_prompt!

wbadmin.exe delete catalog -quiet


Atomic Test #3 - Windows - Disable Windows Recovery Console Repair

Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.

Supported Platforms: Windows

Run it with command_prompt!

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled no


Atomic Test #4 - Windows - Overwrite file with Sysinternals SDelete

Overwrites and deletes a file using Sysinternals SDelete. Requires the download of either Sysinternals Suite or the individual SDelete utility.

Supported Platforms: Windows

Inputs

Name Description Type Default Value
file_to_overwrite Path of file to overwrite and remove Path C:\some\file.txt

Run it with command_prompt!

sdelete.exe #{file_to_overwrite}


Atomic Test #5 - macOS/Linux - Overwrite file with DD

Overwrites and deletes a file using DD.

To stop the test, break the command with CTRL/CMD+C.

Supported Platforms: CentOS, Linux, macOS, Ubuntu

Inputs

Name Description Type Default Value
overwrite_source Path of data source to overwrite with Path /dev/zero
file_to_overwrite Path of file to overwrite and remove Path /var/log/syslog

Run it with bash!

dd of=#{file_to_overwrite} if=#{overwrite_source}