Data Destruction

To visit this technique’s new page please go to and update your links to https://attack.mitre.org/techniques/T0809

Data Destruction
Technique
ID	T0809
Tactic	Inhibit Response Function
Data Sources	Command: Command Execution, File: File Deletion, File: File Modification, Process: Process Creation
External Contributors	Matan Dobrushin - Otorio
Asset	Control Server, Human-Machine Interface, Field Controller/RTU/PLC/IED

Description

Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process.1

Data destruction may also be used to render operator interfaces unable to respond and to disrupt response functions from occurring as expected. An adversary may also destroy data backups that are vital to recovery after an incident.

Standard file deletion commands are available on most operating system and device interfaces to perform cleanup, but adversaries may use other tools as well. Two examples are Windows Sysinternals SDelete and Active@ Killdisk.

Procedure Examples

• Industroyer has a destructive wiper that "overwrites all ICS configuration files across the hard drives and all mapped network drives specifically targeting ABB PCM600 configuration files".2
• KillDisk is able to delete system files to make the system unbootable and targets 35 different types of files for deletion.3

Mitigations

• Privileged Account Management - Minimize permissions and access for service accounts to limit the information that may be impacted by malicious users or software.4

• Restrict File and Directory Permissions - Protect files stored locally with proper permissions to limit opportunities for adversaries to impact data storage.4

• Data Backup - Utilize central storage servers for critical operations where possible (e.g., historians) and keep remote backups. For outstations, use local redundant storage for event recorders. Have backup control system platforms, preferably as hot-standbys to respond immediately to data destruction events.4

References

1. ^  Enterprise ATT&CK. (2018, January 11). File Deletion. Retrieved May 17, 2018.
2. ^  Dragos Inc.. (2017, June 13). Industroyer - Dragos - 201706: Analysis of the Threat to Electic Grid Operations. Retrieved September 18, 2017.

3. ^  Anton Cherepanov. (n.d.). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved October 29, 2019.
4. a b c  National Institute of Standards and Technology. (2013, April). Security and Privacy Controls for Federal Information Systems and Organizations. Retrieved September 17, 2020.