ATT&CKcon 7.0 in-person tickets are open! Join us October 27-28, 2026 in McLean, VA. Register here for in-person tickets; hotel and location details can be found in the FAQ.
Detection of Data Destruction
Technique Detected: Data Destruction | T0809
ID: DET0758
Domains: ICS
Analytics: AN1890
Version: 1.0
Created: 21 October 2025
Last Modified: 12 May 2026
Analytics
AN1890
Monitor for changes made to a large quantity of files for unexpected modifications in both user directories and directories used to store programs and OS components (e.g., C:\Windows\System32).
Monitor for newly executed processes of binaries that could be involved in data destruction activity, such as SDelete.
Monitor for unexpected deletion of files.
Monitor executed commands and arguments for binaries that could be involved in data destruction activity, such as SDelete.
Log Sources
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | File | None |
| Process Creation (DC0032) | Process | None |
| File Deletion (DC0040) | File | None |
| Command Execution (DC0064) | Command | None |