// MITRE ATT&CK
T1485.001 · Lifecycle-Triggered Deletion
Sub-técnica de T1485 · Data Destruction.
Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within. Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time.(Citation: AWS Storage Lifecycles)...
¿Cómo detectarlo y mitigarlo?
La detección de Lifecycle-Triggered Deletion parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1561.002
Disk Structure Wipe T1498.001
Direct Network Flood T1491.002
External Defacement T1499.001
OS Exhaustion Flood T1496.003
SMS Pumping T1499.003
Application Exhaustion Flood T1561
Disk Wipe T1565.001
Stored Data Manipulation
Disk Structure Wipe T1498.001
Direct Network Flood T1491.002
External Defacement T1499.001
OS Exhaustion Flood T1496.003
SMS Pumping T1499.003
Application Exhaustion Flood T1561
Disk Wipe T1565.001
Stored Data Manipulation
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.