Analytics Story: Data Destruction

Updated Date: 2026-05-13 ID: 4ae5c0d1-cebd-47d1-bfce-71bf096e38aa Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and unrecoverable file encryption. This analytic story may cover several known activities related to malware implants used in geo-political war to wipe disks or files to interrupt the network-wide operation of a targeted organization. Analytics can detect the behavior of "DoubleZero Destructor", "CaddyWiper", "AcidRain", "AwfulShred", "Hermetic Wiper", "Swift Slicer", "Whisper Gate" and many more.

Why it matters

Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface or using 3rd party drivers to directly access disk content like Master Boot Record to wipe it. Some of these attacks were seen in geo-political war to impair the operation of targeted organizations or to interrupt network-wide services.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Email Attachments With Lots Of Spaces	Masquerade File Type, Spearphishing Attachment	Anomaly
Windows Deleted Registry By A Non Critical Process File Path	Modify Registry	Anomaly
Linux EFI Bootloader File Deletion	System Firmware, Bootkit	TTP
Linux Auditd Dd File Overwrite	Data Destruction	TTP
Linux Auditd Shred Overwrite Command	Data Destruction	TTP
Windows Data Destruction Recursive Exec Files Deletion	Data Destruction	TTP
Powershell Processing Stream Of Data	PowerShell	Anomaly
Recon AVProduct Through Pwh or WMI	Gather Victim Host Information	TTP
Windows NirSoft AdvancedRun	Tool	TTP
Linux Indicator Removal Service File Deletion	File Deletion	Anomaly
Detect Web Access to Decommissioned S3 Bucket	Data Destruction	Anomaly
Linux Auditd Stop Services	Service Stop	Hunting
Malicious PowerShell Process - Encoded Command	Obfuscated Files or Information	Hunting
WMI Recon Running Process Or Services	Gather Victim Host Information	Anomaly
Windows InstallUtil in Non Standard Path	Rename Legitimate Utilities, InstallUtil	TTP
Windows Modify Show Compress Color And Info Tip Registry	Modify Registry	TTP
Powershell Enable SMB1Protocol Feature	Indicator Removal from Tools	TTP
Add or Set Windows Defender Exclusion	Disable or Modify Tools	TTP
Linux Hardware Addition SwapOff	Hardware Additions	Anomaly
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Linux Adding Crontab Using List Parameter	Cron	Hunting
Ping Sleep Batch Command	Time Based Checks	Anomaly
O365 Email Hard Delete Excessive Volume	Clear Mailbox Data, Data Destruction	Anomaly
Powershell Using memory As Backing Store	PowerShell	TTP
Linux Stop Services	Service Stop	TTP
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
O365 Email Receive and Hard Delete Takeover Behavior	Clear Mailbox Data, Local Email Collection, Data Destruction	Anomaly
Detect Mimikatz With PowerShell Script Block Logging	OS Credential Dumping, PowerShell	TTP
Linux DD File Overwrite	Data Destruction	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe	Anomaly
Child Processes of Spoolsv exe	Exploitation for Privilege Escalation	TTP
Linux Crontab Enumeration	Cron	Hunting
Windows Linked Policies In ADSI Discovery	Domain Account	Anomaly
Windows Root Domain linked policies Discovery	Domain Account	Anomaly
Impacket Lateral Movement smbexec CommandLine Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Suspicious Email Attachment Extensions	Spearphishing Attachment	Anomaly
Excessive File Deletion In WinDefender Folder	Data Destruction	TTP
Linux High Frequency Of File Deletion In Etc Folder	File Deletion, Data Destruction	Anomaly
Windows Attempt To Stop Security Service	Disable or Modify Tools	TTP
Linux Unix Shell Enable All SysRq Functions	Unix Shell	Anomaly
Registry Keys Used For Privilege Escalation	Image File Execution Options Injection	TTP
Impacket Lateral Movement Commandline Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP
Malicious PowerShell Process With Obfuscation Techniques	PowerShell	TTP
Windows High File Deletion Frequency	Data Destruction	Anomaly
Windows Sensitive Registry Hive Dump Via CommandLine	Security Account Manager	TTP
Linux Deleting Critical Directory Using RM Command	Data Destruction	TTP
Linux Auditd Service Restarted	Systemd Timers	Anomaly
Linux Deletion Of Init Daemon Script	File Deletion, Data Destruction	TTP
Windows New Default File Association Value Set	Change Default File Association	Hunting
Wscript Or Cscript Suspicious Child Process	Process Injection, Parent PID Spoofing, Create or Modify System Process	Anomaly
WinEvent Scheduled Task Created Within Public Path	Scheduled Task	TTP
Linux System Network Discovery	System Network Configuration Discovery	Anomaly
Time Provider Persistence Registry	Time Providers	TTP
Active Setup Registry Autostart	Active Setup	TTP
Windows File Without Extension In Critical Folder	Data Destruction	Anomaly
WinEvent Windows Task Scheduler Event Action Started	Scheduled Task	Hunting
O365 Email Password and Payroll Compromise Behavior	Clear Mailbox Data, Local Email Collection, Data Destruction	TTP
PowerShell Domain Enumeration	PowerShell	Anomaly
Windows Processes Killed By Industroyer2 Malware	Service Stop	Anomaly
Windows Hidden Schedule Task Settings	Scheduled Task/Job	TTP
Powershell Fileless Process Injection via GetProcAddress	Process Injection, PowerShell	TTP
Windows Raw Access To Master Boot Record Drive	Disk Structure Wipe	TTP
Suspicious Process With Discord DNS Query	Visual Basic	Anomaly
Linux Shred Overwrite Command	Data Destruction	TTP
Screensaver Event Trigger Execution	Screensaver	TTP
Schtasks Run Task On Demand	Scheduled Task/Job	Anomaly
Linux Deletion Of Cron Jobs	File Deletion, Data Destruction	Anomaly
Powershell Windows Defender Exclusion Commands	Disable or Modify Tools	Anomaly
Windows Terminating Lsass Process	Disable or Modify Tools	Anomaly
Possible Lateral Movement PowerShell Spawn	Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, PowerShell, MMC, Windows Service	Anomaly
Detect DNS Query to Decommissioned S3 Bucket	Data Destruction	Anomaly
MSI Module Loaded by Non-System Binary	DLL	Hunting
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Impacket Lateral Movement WMIExec Commandline Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Runas Execution in CommandLine	Token Impersonation/Theft	Hunting
Linux Data Destruction Command	Data Destruction	Anomaly
Unloading AMSI via Reflection	PowerShell, Disable or Modify Tools	TTP
Windows NirSoft Tool Bundle File Created	Tool	Anomaly
Print Processor Registry Autostart	Print Processors	TTP
ETW Registry Disabled	Trusted Developer Utilities Proxy Execution, Disable or Modify Tools	TTP
Linux Auditd Hardware Addition Swapoff	Hardware Additions	Anomaly
Powershell Execute COM Object	PowerShell, Component Object Model Hijacking	TTP
Powershell Remove Windows Defender Directory	Disable or Modify Tools	Anomaly
Logon Script Event Trigger Execution	Logon Script (Windows)	TTP
Windows NirSoft Utilities	Tool	Hunting
Linux Impair Defenses Process Kill	Disable or Modify Tools	Hunting
Regsvr32 Silent and Install Param Dll Loading	Regsvr32	Anomaly
Linux Deletion Of Services	File Deletion, Data Destruction	TTP
O365 Email Send and Hard Delete Exfiltration Behavior	Clear Mailbox Data, Local Email Collection, Data Destruction	Anomaly
Process Deleting Its Process File Path	Indicator Removal	TTP
Detect Empire with PowerShell Script Block Logging	PowerShell	TTP
Linux High Frequency Of File Deletion In Boot Folder	File Deletion, Data Destruction	TTP
Recon Using WMI Class	PowerShell, Gather Victim Host Information	Anomaly
Executable File Written in Administrative SMB Share	SMB/Windows Admin Shares	TTP
Dump LSASS via comsvcs DLL	LSASS Memory	TTP
Linux Auditd Data Destruction Command	Data Destruction	TTP
Overwriting Accessibility Binaries	Accessibility Features	TTP
Linux Disable Services	Service Stop	TTP
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Web or Application Server Spawning a Shell	External Remote Services, Exploit Public-Facing Application	TTP
Linux Stdout Redirection To Dev Null File	Disable or Modify System Firewall	Anomaly
O365 Email Send and Hard Delete Suspicious Behavior	Clear Mailbox Data, Local Email Collection, Data Destruction	Anomaly
Windows DotNet Binary in Non Standard Path	Rename Legitimate Utilities, InstallUtil	TTP
Windows Disable Memory Crash Dump	Data Destruction	TTP
Linux Possible Bootloader Modification	System Firmware	TTP
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Suspicious Process DNS Query Known Abuse Web Services	Visual Basic	TTP
Set Default PowerShell Execution Policy To Unrestricted or Bypass	PowerShell	TTP
PowerShell Loading DotNET into Memory via Reflection	PowerShell	Anomaly
AdsiSearcher Account Discovery	Domain Account	TTP
Linux Indicator Removal Clear Cache	Indicator Removal	TTP
PowerShell 4104 Hunting	OS Credential Dumping, PowerShell, Downgrade Attack	Hunting
Kerberoasting spn request with RC4 encryption	Kerberoasting	TTP
Linux Service Restarted	Systemd Timers	Anomaly
Linux System Reboot Via System Request Key	System Shutdown/Reboot	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 12	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon for Linux EventID 11	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Linux Auditd Proctitle	Linux	`auditd`	`auditd`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 26	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
AWS Cloudfront	AWS	`aws:cloudfront:accesslogs`	`aws`
Linux Auditd Service Stop	Linux	`auditd`	`auditd`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Office 365 Universal Audit Log	Other	`o365:management:activity`	`o365`
Office 365 Reporting Message Trace	Other	`o365:reporting:messagetrace`	`o365`
Sysmon EventID 9	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Isovalent Process Exec	Other	`cisco:isovalent:processExec`	`not_applicable`
Windows Event Log Security 4698	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Osquery Results	Other	`osquery:results`	`osquery`
Windows Event Log TaskScheduler 200	Windows	`wineventlog`	`WinEventLog:Microsoft-Windows-TaskScheduler/Operational`
Windows Event Log TaskScheduler 201	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 5	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 10	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Linux Auditd Execve	Linux	`auditd`	`auditd`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata:v2`	`not_applicable`
Windows Event Log Security 4769	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 2