{"id":"T1485","name":"Data Destruction","url":"https://attack.mitre.org/techniques/T1485","tactics":["impact"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0146","stix_id":"x-mitre-detection-strategy--c54fdf95-c7ac-4ca4-bd99-273e56da20a5","name":"Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns","url":"https://attack.mitre.org/detectionstrategies/DET0146","analytics":[{"id":"AN0411","stix_id":"x-mitre-analytic--791dfdd4-b04d-498a-accc-ee9e2acc7b14","name":"Analytic 0411","description":"Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0411","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=23","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TargetFilename","description":"Filter file deletion activity to sensitive locations (e.g., %System32%, Documents, DB paths)."},{"field":"ProcessCommandLine","description":"Tune for aggressive overwrite flags (e.g., /w, /q, /s) or temp file overwrites."},{"field":"VolumeThreshold","description":"Threshold of unique file deletions or modifications within time window."},{"field":"TimeWindow","description":"Correlate rapid file delete/overwrite behavior from same process/user."}],"live":true,"detection_strategies":["DET0146"],"techniques":["T1485"]},{"id":"AN0412","stix_id":"x-mitre-analytic--839d7053-fc62-433a-8eb2-ed87605160f7","name":"Analytic 0412","description":"Massive recursive deletions or overwrites via `rm -rf`, `shred`, `dd`, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0412","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"unlink, unlinkat, openat, write","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ExecutablePath","description":"Focus on binaries like shred, dd, wipe, custom wipers, or bash execution chains."},{"field":"DeletedPathPattern","description":"Tune for critical mount points or home/data directories."},{"field":"SyscallBurstRate","description":"Rate of unlink/unlinkat syscalls to indicate mass deletion in a short period."}],"live":true,"detection_strategies":["DET0146"],"techniques":["T1485"]},{"id":"AN0413","stix_id":"x-mitre-analytic--5e1b310a-ce3d-4271-83e0-87cd2862f959","name":"Analytic 0413","description":"Destruction via `rm -rf`, overwrite with `dd` or `srm`, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0413","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"exec rm -rf|dd if=/dev|srm|file unlink","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"process.*exit.*code","data_component":"DC0033","data_component_name":"Process Termination","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CommandPattern","description":"Focus on high-risk patterns in temporary directories or key system paths."},{"field":"EntropyChangeRate","description":"Optional anomaly detection on overwritten files with high-entropy payloads."}],"live":true,"detection_strategies":["DET0146"],"techniques":["T1485"]},{"id":"AN0414","stix_id":"x-mitre-analytic--c6f35e44-459c-456b-97a7-997eb2baefb9","name":"Analytic 0414","description":"Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with `Delete*` or `TerminateInstances`.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0414","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances","data_component":"DC0022","data_component_name":"Cloud Storage Deletion","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"OperationType","description":"Correlate multiple destructive API calls over short intervals."},{"field":"UserAgent","description":"Flag non-console/API clients initiating destructive behavior."},{"field":"RegionScope","description":"Observe whether deletions span multiple regions or org accounts."}],"live":true,"detection_strategies":["DET0146"],"techniques":["T1485"]},{"id":"AN0415","stix_id":"x-mitre-analytic--9ea1e329-691a-43a7-b56d-affbc00fb9e7","name":"Analytic 0415","description":"Adversary destroys virtual disks (VMDK), images, or VMs by invoking `vim-cmd`, deleting datastore contents, or purging snapshots.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0415","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"file delete|datastore purge","data_component":"DC0098","data_component_name":"Volume Deletion","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"DatastorePath","description":"Targeted deletion of critical VMDKs or VM configuration files."},{"field":"InitiatingUser","description":"Detect deletions from users outside normal maintenance windows."}],"live":true,"detection_strategies":["DET0146"],"techniques":["T1485"]},{"id":"AN0416","stix_id":"x-mitre-analytic--7735a0b1-f3bc-44fc-a909-75738e77bded","name":"Analytic 0416","description":"Container process executes destructive file operations inside volume mounts or host paths. Includes `rm -rf /mnt/volumes/`, container breakout followed by host deletion attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0146#AN0416","platforms":["Containers"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"unlink, unlinkat, rmdir","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"},{"name":"docker:events","channel":"container exec rm|container stop --force","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"docker-events"}],"mutable_elements":[{"field":"MountPoint","description":"Identify when deletions occur inside persistent or shared volume paths."},{"field":"ContainerImage","description":"Correlate destructive behavior with unknown or untrusted container sources."}],"live":true,"detection_strategies":["DET0146"],"techniques":["T1485"]}],"live":true,"version":"1.0","techniques":["T1485"]}],"sigma_rules":[{"id":"00321fee-ca72-4cce-b011-5415af3b9960","title":"MSSQL Destructive Query","author":"Daniel Degasperi '@d4ns4n_'","status":"experimental","level":"medium","date":"2025-06-04","modified":null,"description":"Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as \"DROP TABLE\" or \"DROP DATABASE\".\n","references":["https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16","https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16","https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16"],"logsource":{"product":"windows","service":"application"},"tags":["attack.exfiltration","attack.impact","attack.t1485"],"path":"rules/windows/builtin/application/mssqlserver/win_mssql_destructive_query.yml","techniques":["T1485"],"cves":[]},{"id":"08d6ac24-c927-4469-b3b7-2e422d6e3c43","title":"Azure Kubernetes Network Policy Change","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a Azure Kubernetes network policy is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a service account is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1531","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","techniques":["T1531","T1485","T1496","T1489"],"cves":[]},{"id":"25cb259b-bbdc-4b87-98b7-90d7c72f8743","title":"Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"2953194b-e33c-4859-b9e8-05948c167447","title":"DD File Overwrite","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"low","date":"2021-10-15","modified":"2022-07-07","description":"Detects potential overwriting and deletion of a file using DD.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.impact","attack.t1485"],"path":"rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml","techniques":["T1485"],"cves":[]},{"id":"33d50d03-20ec-4b74-a74e-1e65a38af1c0","title":"AWS EKS Cluster Created or Deleted","author":"Austin Songer","status":"test","level":"low","date":"2021-08-16","modified":"2022-10-09","description":"Identifies when an EKS cluster is created or deleted.","references":["https://any-api.com/amazonaws_com/eks/docs/API_Description"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.impact","attack.t1485"],"path":"rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml","techniques":["T1485"],"cves":[]},{"id":"37222991-11e9-4b6d-8bdf-60fbe48f753e","title":"Overwriting the File with Dev Zero or Null","author":"Jakob Weinzettl, oscd.community","status":"stable","level":"low","date":"2019-10-23","modified":null,"description":"Detects overwriting (effectively wiping/deleting) of a file.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.impact","attack.t1485"],"path":"rules/linux/auditd/execve/lnx_auditd_dd_delete_file.yml","techniques":["T1485"],"cves":[]},{"id":"39a80702-d7ca-4a83-b776-525b1f86a36d","title":"Potential Secure Deletion with SDelete","author":"Thomas Patzke","status":"test","level":"medium","date":"2017-06-14","modified":"2024-12-13","description":"Detects files that have extensions commonly seen while SDelete is used to wipe files.","references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm","https://www.jpcert.or.jp/english/pub/sr/ir_research.html","https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete"],"logsource":{"product":"windows","service":"security"},"tags":["attack.impact","attack.stealth","attack.defense-impairment","attack.t1070.004","attack.t1027.005","attack.t1485","attack.t1553.002","attack.s0195"],"path":"rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml","techniques":["T1070.004","T1027.005","T1485","T1553.002"],"cves":[]},{"id":"46530378-f9db-4af9-a9e5-889c177d3881","title":"Azure Device or Configuration Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-09-03","modified":"2022-10-09","description":"Identifies when a device or device configuration in azure is modified or deleted.","references":["https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1565.001"],"path":"rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml","techniques":["T1485","T1565.001"],"cves":[]},{"id":"4b046706-5789-4673-b111-66f25fe99534","title":"Deleted Data Overwritten Via Cipher.EXE","author":"frack113","status":"test","level":"medium","date":"2021-12-26","modified":"2023-02-21","description":"Detects usage of the \"cipher\" built-in utility in order to overwrite deleted data from disk.\nAdversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.\nData destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1485"],"path":"rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml","techniques":["T1485"],"cves":[]},{"id":"6a7ba45c-63d8-473e-9736-2eaabff79964","title":"AWS EFS Fileshare Mount Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-15","modified":"2022-10-09","description":"Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.","references":["https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.impact","attack.t1485"],"path":"rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml","techniques":["T1485"],"cves":[]},{"id":"78a34b67-3c39-4886-8fb4-61c46dc18ecd","title":"Microsoft 365 - Unusual Volume of File Deletion","author":"austinsonger","status":"test","level":"medium","date":"2021-08-19","modified":"2022-10-09","description":"Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.","references":["https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy","https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference"],"logsource":{"product":"m365","service":"threat_management"},"tags":["attack.impact","attack.t1485"],"path":"rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml","techniques":["T1485"],"cves":[]},{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"818fee0c-e0ec-4e45-824e-83e4817b0887","title":"Azure Kubernetes Sensitive Role Access","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when ClusterRoles/Roles are being modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"93e0ef48-37c8-49ed-a02c-038aab23628e","title":"Azure Container Registry Created or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-08-07","modified":"2022-08-23","description":"Detects when a Container Registry is created or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"9541f321-7cba-4b43-80fc-fbd1fb922808","title":"Azure Kubernetes Cluster Created or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-08-07","modified":"2022-08-23","description":"Detects when a Azure Kubernetes Cluster is created or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"999e8307-a775-4d5f-addc-4855632335be","title":"Potential BlackByte Ransomware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-02-08","description":"Detects command line patterns used by BlackByte ransomware in different operations","references":["https://redcanary.com/blog/blackbyte-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.impact","attack.stealth","attack.t1485","attack.t1498","attack.t1059.001","attack.t1140","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml","techniques":["T1485","T1498","T1059.001","T1140"],"cves":[]},{"id":"a4824fca-976f-4964-b334-0621379e84c4","title":"Potential File Overwrite Via Sysinternals SDelete","author":"frack113","status":"test","level":"high","date":"2021-06-03","modified":"2023-02-28","description":"Detects the use of SDelete to erase a file not the free space","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1485"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml","techniques":["T1485"],"cves":[]},{"id":"add64136-62e5-48ea-807e-88638d02df1e","title":"Fsutil Suspicious Invocation","author":"Ecco, E.M. Anhaus, oscd.community","status":"stable","level":"high","date":"2019-09-26","modified":"2023-09-09","description":"Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).\nMight be used by ransomwares during the attack (seen by NotPetya and others).\n","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md","https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html","https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md","https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.stealth","attack.t1070","attack.t1485"],"path":"rules/windows/process_creation/proc_creation_win_fsutil_usage.yml","techniques":["T1070","T1485"],"cves":[]},{"id":"c1d867fe-8d95-4487-aab4-e53f2d339f90","title":"Renamed Sysinternals Sdelete Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-06","modified":"2026-06-29","description":"Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1485"],"path":"rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml","techniques":["T1485"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-25257","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-25181","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-21391","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-39226","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2018-7600","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-22986","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}