Data Destruction: Lifecycle-Triggered Deletion T1485.001

Tactic: Impact

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType3eq 2, in 1PutBucketLifecycle, deleteimportedkeymaterial, disablekey, schedulekeydeletion
data_stream.dataset3eq 3aws.cloudtrail
event.outcome3eq 3success
Provider_Name2eq 2kms.amazonaws.com
aws::eventName2eq 2putbucketlifecycle
sourcetype2eq 2aws:asl, aws:cloudtrail
NoncurrentDays1lt 13
aws::errorCode1eq 1success
aws::requestParameters1contains 1expiration=
user_type1eq 1iamuser

Top indicator values (14 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
data_stream.dataseteq
aws.cloudtrail
3173
event.outcomeeq
success
3375
Provider_Nameeq
kms.amazonaws.com
23
aws::eventNameeq
putbucketlifecycle
22
EventTypeeq
PutBucketLifecycle
1
EventTypeeq
deleteimportedkeymaterial
1
EventTypein
disablekey
1
EventTypein
schedulekeydeletion
1
NoncurrentDayslt
3
1
aws::errorCodeeq
success
116
aws::requestParameterscontains
expiration=
1
sourcetypeeq
aws:asl
127
sourcetypeeq
aws:cloudtrail
159
user_typeeq
iamuser
13

Exclusions (3 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Elastic 3 rules

Splunk 2 rules