splunk-security_content/docs/_stories/data_destruction.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Data Destruction	2022-02-14	true		Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Exploitation

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and encrypting files.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2022-02-14
• Author: Teoderick Contreras, Splunk
• ID: 4ae5c0d1-cebd-47d1-bfce-71bf096e38aa

Narrative

Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.

Detections

Name	Technique	Type
Linux DD File Overwrite	Data Destruction	TTP
Windows Disable Memory Crash Dump	Data Destruction	TTP
Windows File Without Extension In Critical Folder	Data Destruction	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe, Disk Wipe	Anomaly

Reference

• https://attack.mitre.org/techniques/T1485/
• https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
• https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware

source | version: 1