Detection coverage in DCV across AWS, Azure and GCP for Data Destruction, plus the corresponding Sigma rules in the CloudSigma library. Source data refreshed 2026-04-24.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable. In some cases politically oriented image files have been used to overwrite data.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers. Similarly, they may delete virtual machines from on-prem virtualized environments.
Platforms: Containers, ESXi, IaaS, Linux, macOS, Windows.
DCV maps 60 detections across 3 cloud providers to T1485. Coverage by source:
| Source | Cloud | Findings mapped | Avg confidence |
|---|---|---|---|
| AWS Config Rules | AWS | 28 | 0.62 |
| AWS Security Hub | AWS | 13 | 0.78 |
| AWS GuardDuty | AWS | 10 | 0.86 |
| Microsoft Defender for Cloud | Azure | 4 | 0.90 |
| Azure Policy | Azure | 3 | 0.90 |
| Azure Regulatory Compliance | Azure | 1 | 0.90 |
| GCP Chronicle | GCP | 1 | 0.95 |
CloudSigma ships 3 production-ready Sigma rules that detect T1485 across 3 platforms. Every rule below is validated against its source SIEM dialect before publication.
This rule is currently experimental. CloudSigma generated it from upstream threat intelligence; before enabling in production, tune the falsepositives section in your SIEM against your environment's known automation, service accounts and IP allowlist.
title: AWS Resource Deletion Indicating Data Destruction
id: 4d5e6f7a-8b9c-4d0e-1f2a-3b4c5d6e7f81
status: experimental
description: >
Detects deletion of critical AWS resources such as S3 buckets, RDS instances,
or EC2 instances that may indicate data destruction by an adversary attempting
to cause impact or cover their tracks.
author: CloudSigma
date: 2026-02-06
references:
- https://attack.mitre.org/techniques/T1485/
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-bucket.html
tags:
- attack.impact
- attack.t1485
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventName:
- DeleteBucket
- DeleteDBInstance
- DeleteDBCluster
- TerminateInstances
- DeleteVolume
- DeleteSnapshot
filter_failed:
errorCode|contains: Denied
condition: selection and not filter_failed
falsepositives:
- Scheduled decommissioning of test or development environment resources
- Automated cleanup of ephemeral resources by CI/CD pipelines after integration tests
level: high