CmdID

CmdID / Techniques

T1485 Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. MITRE ATT&CK

3 programs on CmdID 6 Sigma rules T1485 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
cipher.exeTamperddits Sigma rulesfsutil.exeTamper

Sigma rules tagged with it

process creation, the highest levels first
highFsutil Suspicious InvocationEcco, E.M. Anhaus, oscd.community · Windows
highPotential BlackByte Ransomware ActivityFlorian Roth (Nextron Systems) · Windows
highPotential File Overwrite Via Sysinternals SDeletefrack113 · Windows
highRenamed Sysinternals Sdelete ExecutionFlorian Roth (Nextron Systems) · Windows
mediumDeleted Data Overwritten Via Cipher.EXEfrack113 · Windows
lowDD File OverwriteRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Delete files with 3 passes on the page for sdelete

sdelete -p 3 path\to\file1 path\to\file2 ...Identify

Delete folders and its subdirectories with 1 pass (default) on the page for sdelete

sdelete -s path\to\directory1 path\to\directory2 ...Identify

Clean the free space of volume D: with 3 passes on the page for sdelete

sdelete -p 3 D:Identify

An example is here when CmdID’s reading of it names T1485: a Sigma rule it trips is tagged with it, or its abuse is documented as it.