T1485 Data Destruction

2 threats tracked by Spectrum Delta use this technique.

T1485 on MITRE ATT&CK →

• n0n credential extortion

  Destructive S3 deletion in 1000-item batches with ransom-note drop

  CloudTrail S3 data events (DeleteObjects, PutObject)

  Seen in: AWS CloudTrail

• MythicRatatoskr Yggdrasil C2

  SDelete execution for data wiping (GPO-distributed)

  Sysmon EID 1 process creation (OriginalFileName sdelete.exe) on endpoints; GPO modification telemetry as environment-dependent corroboration

  Seen in: Sysmon / EDR