Last reviewed:
T1485 is data destruction at scale, often part of an extortion campaign or an attempt to impair ransomware recovery. Cloud variants include S3 versioning bypass, snapshot deletion, and large-scale object purges. DCV's T1485 mapping pairs GuardDuty Impact:S3/MaliciousIPCaller findings with GCP KMS_KEY_DESTROYED: destruction caught both at the data tier and at the encryption-key tier. T1485 detection is closely tied to the recoverability of your cloud-resident data.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.
Platforms: Containers, ESXi, IaaS, Linux, macOS, Windows.
DCV maps 60 detections across 3 cloud providers to T1485. Coverage by source:
| Source | Cloud | Findings mapped | Avg confidence |
|---|---|---|---|
| AWS Config Rules | AWS | 28 | 0.62 |
| AWS Security Hub | AWS | 13 | 0.78 |
| AWS GuardDuty | AWS | 10 | 0.86 |
| Microsoft Defender for Cloud | Azure | 4 | 0.90 |
| Azure Policy | Azure | 3 | 0.90 |
| Azure Regulatory Compliance | Azure | 1 | 0.90 |
| GCP Chronicle | GCP | 1 | 0.95 |
CloudSigma ships 60 production-ready Sigma rules that detect T1485 across 3 platforms. Every rule below is validated against its source SIEM dialect before publication.
title: Azure Resource Deletion Indicating Data Destruction
id: 3900f354-2d16-403d-81c2-336ecf6b493b
status: test
description: >
Detects deletion of critical Azure resources such as storage accounts,
SQL databases, or virtual machines that may indicate data destruction
by an adversary attempting to cause impact.
author: CloudSigma
date: 2026-02-06
references:
- https://attack.mitre.org/techniques/T1485/
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group
tags:
- attack.impact
- attack.t1485
logsource:
product: azure
service: activitylogs
detection:
selection:
operationName.value:
- Microsoft.Storage/storageAccounts/delete
- Microsoft.Sql/servers/databases/delete
- Microsoft.Compute/virtualMachines/delete
- Microsoft.Compute/disks/delete
status.value: Succeeded
condition: selection
falsepositives:
- Planned decommissioning of development or staging Azure resource groups
- Azure DevTest Labs automated cleanup of expired virtual machines
level: high
T1485 is data destruction at scale, often part of an extortion campaign or an attempt to impair ransomware recovery. Cloud variants include S3 versioning bypass, snapshot deletion, and large-scale object purges. DCV's T1485 mapping pairs GuardDuty Impact:S3/MaliciousIPCaller findings with GCP KMS_KEY_DESTROYED: destruction caught both at the data tier and at the encryption-key tier. T1485 detection is closely tied to the recoverability of your cloud-resident data.
DCV maps 60 cloud-native detections to T1485 across 3 cloud providers, drawn from AWS Config Rules, AWS GuardDuty, AWS Security Hub, Azure Policy, Azure Regulatory Compliance, GCP Chronicle and Microsoft Defender for Cloud.
T1485 is part of MITRE ATT&CK TA0040 Impact: How adversaries disrupt or destroy systems and data.
CloudSigma ships 3 validated Sigma rules for T1485 across AWS CloudTrail, Azure Activity and GCP Audit Logs. Each rule is validated against its source SIEM dialect before publication.