{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","url":"https://attack.mitre.org/techniques/T1485/001","tactics":["impact"],"platforms":["IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0041","stix_id":"x-mitre-detection-strategy--cfdf2a13-7059-4532-9d1c-f9129b0e3f7b","name":"Detection of Lifecycle Policy Modifications for Triggered Deletion in IaaS Cloud Storage","url":"https://attack.mitre.org/detectionstrategies/DET0041","analytics":[{"id":"AN0117","stix_id":"x-mitre-analytic--f6f90ad5-3182-4b1a-a612-51b251a8a34c","name":"Analytic 0117","description":"Adversary with write access to storage modifies lifecycle policies (e.g., via PutBucketLifecycle) to schedule rapid object deletion across one or more storage buckets. This is often used to trigger impact (destruction), remove logs (defense evasion), or force extortion (ransomware).","url":"https://attack.mitre.org/detectionstrategies/DET0041#AN0117","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"PutBucketLifecycle, PutLifecycleConfiguration, SetBucketLifecycle, storage.buckets.update","data_component":"DC0023","data_component_name":"Cloud Storage Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"LifecycleExpirationDays","description":"Policy values setting Expiration in fewer than N days (e.g., 0–1) are highly suspicious."},{"field":"TargetBucket","description":"Filter by bucket types (e.g., log storage, production DB snapshots) to prioritize detection."},{"field":"Principal","description":"Correlate rare or anomalous IAM principals making destructive lifecycle changes."},{"field":"TimeWindow","description":"Link lifecycle policy change with API activity suggesting staged deletion or extortion attempt."}],"live":true,"detection_strategies":["DET0041"],"techniques":["T1485.001"]}],"live":true,"version":"1.0","techniques":["T1485.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}