{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--1001e0d6-ee09-4dfc-aa90-e9320ffc8fe4",
  "created": "2024-09-25T13:16:14.166Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1485/001",
      "external_id": "T1485.001"
    },
    {
      "source_name": "AWS Storage Lifecycles",
      "description": "AWS. (n.d.). Managing the lifecycle of objects. Retrieved September 25, 2024.",
      "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html"
    },
    {
      "source_name": "GCP Storage Lifecycles",
      "description": "Google Cloud. (n.d.). Object Lifecycle Management. Retrieved September 25, 2024.",
      "url": "https://cloud.google.com/storage/docs/lifecycle"
    },
    {
      "source_name": "Halcyon AWS Ransomware 2025",
      "description": "Halcyon RISE Team. (2025, January 13). Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C. Retrieved March 18, 2025.",
      "url": "https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c"
    },
    {
      "source_name": "Azure Storage Lifecycles",
      "description": "Microsoft Azure. (2024, July 3). Configure a lifecycle management policy. Retrieved September 25, 2024.",
      "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal"
    },
    {
      "source_name": "Palo Alto Cloud Ransomware",
      "description": "Ofir Balassiano and Ofir Shaty. (2023, November 29). Ransomware in the Cloud: Breaking Down the Attack Vectors. Retrieved September 25, 2024.",
      "url": "https://www.paloaltonetworks.com/blog/prisma-cloud/ransomware-data-protection-cloud/"
    },
    {
      "source_name": "Datadog S3 Lifecycle CloudTrail Logs",
      "description": "Stratus Red Team. (n.d.). CloudTrail Logs Impairment Through S3 Lifecycle Rule. Retrieved September 25, 2024.",
      "url": "https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-04-15T19:58:06.787Z",
  "name": "Lifecycle-Triggered Deletion",
  "description": "Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.  \n\nCloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time.(Citation: AWS Storage Lifecycles)(Citation: GCP Storage Lifecycles)(Citation: Azure Storage Lifecycles) If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once. \n\nFor example, in AWS environments, an adversary with the `PutLifecycleConfiguration` permission may use the `PutBucketLifecycle` API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day.(Citation: Palo Alto Cloud Ransomware)(Citation: Halcyon AWS Ransomware 2025) In addition to destroying data for purposes of extortion and [Financial Theft](https://attack.mitre.org/techniques/T1657), adversaries may also perform this action on buckets storing cloud logs for [Indicator Removal](https://attack.mitre.org/techniques/T1070).(Citation: Datadog S3 Lifecycle CloudTrail Logs)",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "impact"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "IaaS"
  ],
  "x_mitre_version": "1.1",
  "x_mitre_impact_type": [
    "Availability"
  ]
}