They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.Īdversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.Īdversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Live Version Techniques Techniques: 13 IDĪdversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |