Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Impact/ T1485

T1485Data Destruction

T1485 — Data Destruction is a MITRE ATT&CK technique in the Impact tactic. Clankerusecase tracks 67 detection use cases covering it and 17 threat-intel articles citing it.

Impact
View on the matrix → Filter Detection Library MITRE official spec ↗
67Use cases
17Articles
1Sub-techniques
1Tactic

Sub-techniques (1)

T1485.001 · Lifecycle-Triggered Deletion

Use cases covering this technique (67)

AWS ECS cluster deleted Internal actions · alerting DDCW AWS KMS key deleted or scheduled for deletion Internal actions · alerting DDCW AWS RDS DB cluster deleted Internal actions · alerting DDCW Azure storage soft-delete disabled Internal actions · alerting DD GitHub mass repository deletion Internal actions · alerting DD MongoDB database dropped Internal actions · alerting DD PostgreSQL database dropped Internal actions · alerting DD AWS Bedrock Delete Knowledge Base ESCU actions · alerting P GitHub Enterprise Remove Organization ESCU actions · hunting P GitHub Enterprise Repository Archived ESCU actions · hunting P GitHub Enterprise Repository Deleted ESCU actions · hunting P GitHub Organizations Repository Archived ESCU actions · hunting P GitHub Organizations Repository Deleted ESCU actions · hunting P O365 Email Hard Delete Excessive Volume ESCU actions · hunting P O365 Email Password and Payroll Compromise Behavior ESCU actions · alerting P O365 Email Receive and Hard Delete Takeover Behavior ESCU actions · hunting P O365 Email Send and Hard Delete Exfiltration Behavior ESCU actions · hunting P O365 Email Send and Hard Delete Suspicious Behavior ESCU actions · hunting P O365 Email Send Attachments Excessive Volume ESCU actions · hunting P Common Ransomware Extensions ESCU actions · alerting P Common Ransomware Notes ESCU actions · hunting P Excessive File Deletion In WinDefender Folder ESCU actions · alerting P Linux Account Manipulation Of SSH Config and Keys ESCU actions · hunting P Linux Auditd Data Destruction Command ESCU actions · alerting P Linux Auditd Dd File Overwrite ESCU actions · alerting P Linux Auditd Shred Overwrite Command ESCU actions · alerting P Linux Data Destruction Command ESCU actions · alerting P Linux DD File Overwrite ESCU actions · alerting P Linux Deleting Critical Directory Using RM Command ESCU actions · alerting P Linux Deletion Of Cron Jobs ESCU actions · hunting P Linux Deletion Of Init Daemon Script ESCU actions · alerting P Linux Deletion Of Services ESCU actions · alerting P Linux Deletion of SSL Certificate ESCU actions · hunting P Linux High Frequency Of File Deletion In Boot Folder ESCU actions · alerting P Linux High Frequency Of File Deletion In Etc Folder ESCU actions · hunting P Linux Shred Overwrite Command ESCU actions · alerting P Sdelete Application Execution ESCU actions · alerting P Windows Data Destruction Recursive Exec Files Deletion ESCU actions · alerting P Windows Disable Memory Crash Dump ESCU actions · alerting P Windows File Without Extension In Critical Folder ESCU actions · hunting P Windows High File Deletion Frequency ESCU actions · hunting P Detect DNS Query to Decommissioned S3 Bucket ESCU actions · hunting P Detect Web Access to Decommissioned S3 Bucket ESCU actions · hunting P [LLM] GitLab GraphQL mutation delivered over HTTP GET to /api/graphql (CVE-2026-19650) Bespoke exploit · hunting SΣP [LLM] Client-side WebDAV MOVE with Overwrite:T header (goshs --no-delete bypass exploitation) Bespoke actions · alerting DSΣPDDCS [LLM] WebDAV DELETE blocked (403) then MOVE succeeds (2xx) — goshs --no-delete bypass signature Bespoke actions · alerting SP [LLM] Bulk WebDAV MOVE (2xx) from single source — mass destruction via goshs bypass Bespoke actions · alerting SP [LLM] LightRAG destructive document ops post-bypass (DELETE /documents, clear_cache, unauth upload) Bespoke actions · alerting SΣP [LLM] LightRAG CVE-2026-61736: cross-origin DELETE of document store (destructive CORS abuse) Bespoke actions · alerting SP [LLM] n8n-MCP destructive workflow version backup deletion (delete/prune/truncate) — CVE-2026-54052 impact Bespoke actions · alerting SΣP [LLM] Sha1-Hulud destructive wiper fallback (cipher /W, recursive del, shred over home dir) Bespoke actions · alerting DSΣPDDCS [LLM] YesWiki unauthenticated erasespamedcomments page-deletion invocation (CVE-2026-52766) Bespoke exploit · alerting SΣP [LLM] YesWiki confirmed mass page deletion — bulk 'Suppression de la page' / deletion-request burst (CVE-2026-52766) Bespoke actions · alerting SP [LLM] YesWiki page-deletion aftermath — 404 spike on previously-valid wiki pages (CVE-2026-52766) Bespoke actions · hunting SP [LLM] Locale-conditional rm -rf wiper command from python/node runtime Bespoke actions · alerting DSΣPDDCS [LLM] AI coding agent bulk-deleting JUnit test files after jqwik resolution Bespoke actions · alerting DSPDDCS [LLM] Compromised kubernetes.el destructive payload — Emacs spawning `rm -rf / --no-preserve-root` Bespoke actions · alerting DSΣPDD [LLM] DynoWiper / ZOV wiper known-bad SHA-1 hash execution Bespoke install · alerting DSΣPDDCS [LLM] DynoWiper schtask.exe / *_update.exe execution from C:\inetpub\pub\ Bespoke install · alerting DSΣPDDCS [LLM] Mass file-content overwrite by single non-system process from non-standard path Bespoke actions · hunting DSPDDCS [LLM] DynoWiper deployment from shared inetpub\pub directory (Sandworm, Poland Dec 2025) Bespoke install · alerting DSΣP [LLM] DynoWiper PDB-string + vagrant build artefact in loaded modules Bespoke install · hunting DSΣP [LLM] SHA1-Hulud wiper: mass deletion of user home directory by npm/node descendant Bespoke actions · alerting DSPDDCS [LLM] node-ipc destructive wiper component ssl-geospec.js written under node_modules\node-ipc\dao Bespoke install · alerting DSΣPDDCS [LLM] peacenotwar payload: creation of WITH-LOVE-FROM-AMERICA.txt protest file Bespoke actions · alerting DSΣPDDCS [LLM] node-ipc destructive payload artifact (dao/ssl-geospec.js) on disk Bespoke install · alerting DSΣPDDCS [LLM] Mass file overwrite by Node runtime (node-ipc heart-emoji data destruction) Bespoke actions · hunting DSPDDCS

Articles citing this technique (17)

crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
crit [GHSA / CRITICAL] CVE-2026-64863: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite art-184
crit [GHSA / CRITICAL] CVE-2026-61740: LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status de art-242
crit [GHSA / CRITICAL] CVE-2026-61736: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests art-243
crit [GHSA / CRITICAL] CVE-2026-54052: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments art-272
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-292
crit [GHSA / CRITICAL] CVE-2026-52766: YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action art-307
high Why EDR and proxy won’t save you from supply chain malware art-415
high Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection art-421
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-627
crit DynoWiper update: Technical analysis and attribution art-717
high ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 art-728
high SHA1-Hulud, npm supply chain incident art-796
crit NPM security: preventing supply chain attacks art-1952
crit The npm faker package and the unexpected demise of open source libraries art-2058
crit Protestware is trending in open source: 4 different types and their impact art-2480
high Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine art-2482