Sub-technique of T1485 Data Destruction.View on attack.mitre.org
Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.
Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time. If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once.
For example, in AWS environments, an adversary with the `PutLifecycleConfiguration` permission may use the `PutBucketLifecycle` API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day. In addition to destroying data for purposes of extortion and Financial Theft, adversaries may also perform this action on buckets storing cloud logs for Indicator Removal.
Rules on DetectionCode tagged with T1485.001.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| ASL AWS Defense Evasion PutBucketLifecycle | Hunting | NULL | ASL AWS CloudTrail |
| AWS Defense Evasion PutBucketLifecycle | Hunting | NULL | AWS CloudTrail PutBucketLifecycle |
None recorded.
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
