Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1485.001 Lifecycle-Triggered Deletion · cyberstrikeus | DecimalAI

cyberstrikeus/T1485.001_lifecycle-triggered-deletion

SkillScore87Maintained

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1485.001

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1485-001-lifecycle-triggered-deletion/SKILL.md

decimalai skills pull cyberstrikeus-t1485-001-lifecycle-triggered-deletion --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1485-001-lifecycle-triggered-deletion/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1485-001-lifecycle-triggered-deletion/SKILL.md

Raw file: /s/cyberstrikeus-t1485-001-lifecycle-triggered-deletion/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1485-001-lifecycle-triggered-deletion.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +39% lift-1% tokens0% turns87% of whole cases pass with skill (20/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	65%	0%
case-07	✗→✓	▲ Improved	-39%	0%
case-09	✗→✓	▲ Improved	-25%	0%
case-10	✗→✓	▲ Improved	-52%	0%
case-12	✗→✓	▲ Improved	79%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1485.001_lifecycle-triggered-deletion/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1485.001 Lifecycle-Triggered Deletion

> Sub-technique of: T1485

High-Level Description

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time. If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once.

For example, in AWS environments, an adversary with the PutLifecycleConfiguration permission may use the PutBucketLifecycle API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day. In addition to destroying data for purposes of extortion and Financial Theft, adversaries may also perform this action on buckets storing cloud logs for Indicator Removal.

Kill Chain Phase

Impact (TA0040)

Platforms: IaaS

What to Check

] Identify if Lifecycle-Triggered Deletion technique is applicable to target environment
] Check IaaS systems for indicators of Lifecycle-Triggered Deletion
] Verify mitigations are bypassed or absent (2 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Lifecycle-Triggered Deletion by examining the target platforms (IaaS).

Assess Existing Defenses: Review whether mitigations for T1485.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1018 User Account Management

In cloud environments, limit permissions to modify cloud bucket lifecycle policies (e.g., PutLifecycleConfiguration in AWS) to only those accounts that require it. In AWS environments, consider using Service Control policies to limit the use of the PutBucketLifecycle API call.

M1053 Data Backup

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Detection

Detection of Lifecycle Policy Modifications for Triggered Deletion in IaaS Cloud Storage

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------------- | -------- | ------ | | Lifecycle-Triggered Deletion technique applicable | Low | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1485.001_lifecycle-triggered-deletion would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 20:47 UTC · 23 cases

Lift

+39%

87% vs 48%

Agent turns

0%

1.0 vs 1.0

Tokens

-1%

2,672.09 vs 2,691.43

fail → pass · 10pass → pass · 10fail → fail · 2pass → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-11 To protect our S3 audit log archives against lifecycle-triggered deletion where an attacker sets a 1-day retention rule, our team plans to enable standard in-bucket S3 versioning. Does M1053 (Data Backup) consider in-bucket versioning sufficient, or what backup architecture requirement is specified?	pass→pass	18,064	19,288	+7%	1	1	0%	2,029	3,362	+66%	0	0	—
case-01 We are conducting a cloud security audit across our IaaS infrastructure and are concerned about adversaries abusing storage retention features to wipe S3 bucket data or audit logs. Please generate an assessment guide for evaluating our susceptibility to MITRE ATT&CK sub-technique T1485.001. The output should include an overview of the attack surface, a checklist for manual testing, a risk summary table, and relevant weakness classifications.	fail→fail	31,537	27,198	-14%	1	1	0%	4,547	4,912	+8%	0	0	—
case-02 I need a security briefing on how threat actors execute lifecycle-triggered deletion in cloud environments for data destruction and log removal. Please write a report that details the attack mechanism, kill chain categorization, step-by-step verification procedures, and guidance on how to detect and remediate this vulnerability.	fail→fail	25,545	39,183	+53%	1	1	0%	4,068	5,981	+47%	0	0	—
case-03 Our AWS IAM audit flagged several service accounts with `s3:DeleteObject` and `s3:DeleteObjectVersion` permissions across production buckets. We need a threat report analyzing how adversaries use direct API object deletion to destroy data and bypass object versioning. Please detail the ATT&CK mapping, primary IAM permissions involved, and mitigation strategy.	pass→pass	30,685	33,520	+9%	1	1	0%	4,334	5,075	+17%	0	0	—
case-04 During an infrastructure review of our AWS environment, we discovered that developers have `kms:ScheduleKeyDeletion` permissions on customer managed keys used for encrypting S3 buckets. Please write a threat analysis report covering key revocation/deletion attack vectors, ATT&CK mapping, and recommended IAM restriction policies.	pass→pass	19,342	27,096	+40%	1	1	0%	3,674	5,053	+38%	0	0	—
case-05 An incident response exercise identified that an attacker obtained `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` privileges in our AWS account. Please provide an assessment guide analyzing the technique used to disable cloud logging for defense evasion, including ATT&CK mapping and mitigation steps.	fail→pass	18,326	28,085	+53%	1	1	0%	3,207	5,293	+65%	0	0	—
case-06 We are hardening our AWS IAM policies for S3 cloud storage management. Our devops lead claims that blocking `s3:PutBucketPolicy` is sufficient to prevent attackers from setting automated bucket wiping rules. Please detail the exact IAM permission and API action required to modify lifecycle rules and explain the AWS policy mechanism to restrict it across organizational accounts.	pass→pass	13,635	10,384	-24%	1	1	0%	2,336	3,007	+29%	0	0	—
case-07 Our AppSec team is ingesting cloud infrastructure findings into our defect tracking system. A finding was raised regarding automated lifecycle retention rules being configured to wipe S3 bucket contents. Security engineers want to tag this finding as CWE-269 (Improper Privilege Management) or CWE-284 (Improper Access Control). What is the specific CWE category for lifecycle-triggered deletion?	fail→pass	23,579	10,434	-56%	1	1	0%	3,400	2,088	-39%	0	0	—
case-08 We are auditing our cloud storage defense posture against automated lifecycle deletion attacks. Security consultants suggested implementing five distinct mitigation strategies including MFA Delete, S3 Versioning, KMS rotation, User Account Management, and Data Backup. How many official ATT&CK mitigations exist for T1485.001, and what are their specific mitigation IDs?	pass→pass	12,291	5,199	-58%	1	1	0%	2,015	1,735	-14%	0	0	—
case-09 Our SOC is building SIEM rules for cloud storage threat vectors. Engineers are designing multiple detection playbooks covering network traffic, bucket policy changes, and object access logs. How many detection strategies are documented for lifecycle-triggered deletion in cloud storage, and what is the primary log source to monitor?	fail→pass	21,431	9,907	-54%	1	1	0%	2,403	1,798	-25%	0	0	—
case-10 Our GRC team requires standard formatting for the risk matrix entry when assessing T1485.001. A reviewer drafted a finding titled 'Bucket Lifecycle Vulnerable' with Severity 'High' and Impact 'Availability'. What are the standard Finding title, Severity, and Impact values specified for this assessment?	fail→pass	19,592	3,286	-83%	1	1	0%	3,231	1,556	-52%	0	0	—
case-12 Our threat hunting team is crafting CloudWatch query filters for lifecycle manipulation attacks in AWS S3. Engineers are filtering for `s3:PutBucketLifecycleConfiguration` and `s3:PutBucketPolicy`. What is the precise API call name logged in CloudTrail when a lifecycle policy is applied?	fail→pass	13,379	8,345	-38%	1	1	0%	1,399	2,499	+79%	0	0	—
case-13 We are classifying cloud storage lifecycle manipulation in our threat intelligence platform. An analyst mapped T1485.001 under Defense Evasion (TA0005) because deleting audit logs hides threat activity. What is the official ATT&CK tactic phase and tactic ID for this technique?	pass→pass	16,246	3,983	-75%	1	1	0%	2,108	1,750	-17%	0	0	—
case-14 Our enterprise architecture team is defining the scope of cloud storage security baselines across SaaS, PaaS, and IaaS environments. Which specific platform domain does MITRE ATT&CK designate for sub-technique T1485.001?	pass→pass	27,003	8,551	-68%	1	1	0%	4,330	1,314	-70%	0	0	—
case-15 Provide the manual testing checklist workflow for evaluating T1485.001 vulnerability in cloud environments. How many steps comprise the manual testing guide, and what does the first step analyze?	fail→pass	19,018	3,283	-83%	1	1	0%	2,348	1,629	-31%	0	0	—
case-16 Our red team wants to run automated validation tests for T1485.001 using the Atomic Red Team framework. What specific atomic test number or command should be executed for this sub-technique?	fail→pass	12,745	18,923	+48%	1	1	0%	2,027	2,443	+21%	0	0	—
case-17 Why would a threat actor apply a lifecycle policy deleting S3 bucket objects after one day? Beyond data destruction for ransomware extortion, what second operational objective motivates adversaries to use this technique?	pass→fail	19,701	13,248	-33%	1	1	0%	2,185	2,020	-8%	0	0	—
case-18 Our multi-cloud security architecture team is documenting native lifecycle management features across AWS, GCP, and Azure that could be targeted for triggered deletion attacks. Which cloud provider documentation resources should be reviewed for blob and object lifecycle policies?	pass→pass	14,686	9,352	-36%	1	1	0%	2,630	1,677	-36%	0	0	—
case-19 Our threat intelligence team is compiling case studies on cloud-native ransomware techniques in AWS. Which research report documents threat actors abusing native AWS services to encrypt or destroy S3 buckets using SSE-C?	fail→pass	17,609	9,070	-48%	1	1	0%	2,115	1,779	-16%	0	0	—
case-20 Our SOC engineers are looking for open-source attack simulation references demonstrating CloudTrail logs generated during S3 lifecycle rule manipulation. Which community attack simulation resource provides CloudTrail log examples for this technique?	pass→pass	21,022	9,914	-53%	1	1	0%	2,908	1,954	-33%	0	0	—
case-21 Please list the four assessment checklist items specified for evaluating Lifecycle-Triggered Deletion in IaaS environments.	fail→pass	18,265	7,131	-61%	1	1	0%	2,159	1,348	-38%	0	0	—
case-22 When implementing M1018 (User Account Management) in AWS to defend against bucket lifecycle manipulation, what specific IAM action permission must be restricted, and what AWS organizational mechanism should be used to enforce it?	pass→pass	11,711	8,520	-27%	1	1	0%	1,124	1,591	+42%	0	0	—
case-23 We are writing a cloud remediation standard for storage retention attacks. What two official ATT&CK mitigations form the remediation framework for T1485.001?	fail→pass	12,155	8,267	-32%	1	1	0%	1,326	1,594	+20%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +39 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 47.8%
Pass rate with the skill: 87%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/30/2026, 20:47 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-05

Prompt

An incident response exercise identified that an attacker obtained `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` privileges in our AWS account. Please provide an assessment guide analyzing the technique used to disable cloud logging for defense evasion, including ATT&CK mapping and mitigation steps.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run87

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-3% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.