Not all data destruction looks destructive. T1485.001, Lifecycle Triggered Deletion, uses a feature built for housekeeping. It applies to IaaS and falls under impact.
How attackers use it
Cloud storage buckets often let owners set lifecycle policies that migrate, archive or delete objects after a set period. An adversary with enough permission can change those policies to delete every object at once.
MITRE's example is AWS. An adversary with the PutLifecycleConfiguration permission can use the PutBucketLifecycle API call to apply a policy that deletes all objects in an S3 bucket after one day. The motive may be extortion or financial theft. MITRE also notes adversaries may do this to buckets that store cloud logs, as a way of removing indicators.
The deletion runs inside the provider, so there may be no process on your hosts to see. The change to the policy is the event to catch.
How to detect it
MITRE's detection strategy flags an actor with write access changing a bucket's lifecycle rules to schedule rapid deletion across one or more buckets. MITRE does not name log sources, but the API call is named, so cloud audit logging of storage management calls is the place to look. Alert on lifecycle changes that set very short expiration, especially on log buckets or on buckets where no change is expected.
How to reduce the risk
MITRE lists two mitigations.
- User account management. Limit permission to modify lifecycle policies to accounts that require it. In AWS, consider service control policies to limit PutBucketLifecycle.
- Data backup. Keep backups that are off system and protected from the methods adversaries use to destroy them.
Add versioning on important buckets, and consider a separate account for logs.
Click through it at your own pace, or open it full screen.
Quick check
Which AWS permission lets an adversary change a bucket lifecycle policy?
PutLifecycleConfiguration, used through the PutBucketLifecycle API call.
