T1485Impact
Data Destruction
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as del and rm often only remove…
CVEs31
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.9
Reports1
Detections
20 Sigma rules tagged T1485Data DestructionT148520 general rules
- Fsutil Suspicious Invocationhighstable
- Potential BlackByte Ransomware Activityhightest
- Potential File Overwrite Via Sysinternals SDeletehightest
- Renamed Sysinternals Sdelete Executionhightest
- AWS EFS Fileshare Mount Modified or Deletedmediumtest
- Azure Device or Configuration Modified or Deletedmediumtest
- Azure Kubernetes Network Policy Changemediumtest
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Data Destruction
31 CVEs, by priority. Each link shows its badge.- CVE-2018-7600Drupal Core Remote Code Execution VulnerabilityDrupal · Drupal CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%83.7priority
- CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityF5 · BIG-IP and BIG-IQ Centralized ManagementKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+3 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%79.9priority
- CVE-2023-49105ownCloud Improper Authentication VulnerabilityownCloud · ownCloudKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System+1 moreAI mapping from the description · primary impact43.2%Top 1.3%79.6priority
- CVE-2025-25257Fortinet FortiWeb SQL Injection VulnerabilityFortinet · FortiWebKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+3 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%69.9priority
- CVE-2021-39226Grafana Authentication Bypass VulnerabilityGrafana Labs · GrafanaKEVPublic exploitHigh · 7.3T1190Exploit Public-Facing ApplicationT1485Data DestructionMITRE CTID mapping of the KEV entry · primary impact99.9%Top 0.03%68.1priority
- CVE-2025-25181Advantive VeraCore SQL Injection VulnerabilityAdvantive · VeraCoreKEVPublic exploitHigh · 7.5T1055Process InjectionT1068Exploitation for Privilege Escalation+1 moreMITRE CTID mapping of the KEV entry · primary impact55.5%Top 0.96%68.1priority
- CVE-2016-3715ImageMagick Arbitrary File Deletion VulnerabilityAI mapping from the description · primary impact75.3%Top 0.49%66.8priority
- CVE-2022-23134Zabbix Frontend Improper Access Control VulnerabilityZabbix · FrontendKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1485Data DestructionAI mapping from the description · primary impact95.3%Top 0.13%66.7priority
- CVE-2025-21391Microsoft Windows Storage Link Following VulnerabilityMicrosoft · WindowsKEVHigh · 7.1T1068Exploitation for Privilege EscalationT1485Data Destruction+1 moreMITRE CTID mapping of the KEV entry · primary impact2.3%Top 17%59.6priority
- CVE-2018-8353A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…MITRE CTID mapping of the CVE · follow-on activity67.3%Top 0.7%24.9priority
- CVE-2018-8355A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · follow-on activity67.9%Top 0.68%24.9priority
- CVE-2019-1118A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…MITRE CTID mapping of the CVE · follow-on activity23.6%Top 2.2%24.6priority
- CVE-2020-16874Visual Studio Remote Code Execution VulnerabilityMicrosoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)High · 7.8T1204.002Malicious FileT1574Hijack Execution Flow+5 moreMITRE CTID mapping of the CVE · follow-on activity4.3%Top 8.9%24.4priority
- CVE-2020-1569Microsoft Edge Memory Corruption VulnerabilityMITRE CTID mapping of the CVE · follow-on activity3.0%Top 13%23.6priority
- CVE-2019-3723Web Parameter Tampering VulnerabilityDell EMC · OpenManage Server AdministratorCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the CVE · primary impact1.8%Top 21%22.2priority
- CVE-2020-1456A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…Microsoft · Microsoft SharePoint Enterprise ServerMedium · 5.4T1059Command and Scripting InterpreterT1036Masquerading+3 moreMITRE CTID mapping of the CVE · follow-on activity2.2%Top 17%21.0priority
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · follow-on activity9.8%Top 4.4%19.8priority
- CVE-2018-8248A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…MITRE CTID mapping of the CVE · follow-on activity21.4%Top 2.4%19.5priority
- CVE-2018-8575A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…MITRE CTID mapping of the CVE · follow-on activity19.5%Top 2.6%19.5priority
- CVE-2018-8110A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · follow-on activity16.9%Top 2.9%19.4priority
- CVE-2018-8111A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · follow-on activity16.9%Top 2.9%19.4priority
- CVE-2020-1495Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Server 2010 Service Pack 2T1566PhishingT1204.002Malicious File+6 moreMITRE CTID mapping of the CVE · follow-on activity4.2%Top 9%18.9priority
- CVE-2020-1109Windows Update Stack Elevation of Privilege VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.0%Top 37%18.0priority
- CVE-2020-1111Windows Clipboard Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809High · 7.8T1136Create AccountT1068Exploitation for Privilege Escalation+3 moreMITRE CTID mapping of the CVE · follow-on activity1.0%Top 39%17.7priority
- CVE-2018-5459An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.XMITRE CTID mapping of the CVE · follow-on activity2.7%Top 14%17.2priority
- CVE-2019-1031Microsoft Office SharePoint XSS VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016T1059Command and Scripting InterpreterT1036Masquerading+3 moreMITRE CTID mapping of the CVE · follow-on activity1.7%Top 23%15.3priority
- CVE-2018-8607A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…MITRE CTID mapping of the CVE · follow-on activity1.6%Top 24%15.2priority
- CVE-2020-0671An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…MITRE CTID mapping of the CVE · follow-on activity1.4%Top 28%15.0priority
- CVE-2019-1270An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…MITRE CTID mapping of the CVE · primary impact0.9%Top 40%11.9priority
- CVE-2020-1163An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To…Microsoft · Microsoft Forefront Endpoint ProtectionT1485Data DestructionMITRE CTID mapping of the CVE · primary impact0.9%Top 41%11.8priority
- CVE-2019-3750Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion VulnerabilityMITRE CTID mapping of the CVE · primary impact0.3%Top 75%8.9priority