T1485.001 — Lifecycle-Triggered Deletion

Tactic: Impact · Platforms: IaaS

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within. Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time. If a threat actor has sufficient…

Sub-technique of Data Destruction (T1485).

Sigma detection rules (1)

T1485.001 Data Destruction: Lifecycle-Triggered Deletion

title: "T1485.001 Data Destruction: Lifecycle-Triggered Deletion"
id: e624533f-1717-4757-ab74-19bb07d9ae5e
description: 'Detection of Lifecycle Policy Modifications for Triggered Deletion in IaaS Cloud Storage. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LifecycleExpirationDays, TargetBucket, Principal, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1485/001
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.impact
  - attack.t1485.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutBucketLifecycleConfiguration'
    requestParameters.LifecycleConfiguration.Rule.Expiration.Days|lte: 1

  condition: selection

falsepositives:
  - Legitimate cost-optimization lifecycle policies for genuinely short-lived temporary data can match this pattern, so verify the targeted bucket is not an intentional scratch or cache bucket.

level: high

Explore