← Back to ATT&CK index
T1485
Data Destruction
View on attack.mitre.org →5 syscalls implement this technique
- NtRaiseHardError
Raises a 'hard error' that the kernel routes to CSRSS for UI prompting — or, with SeShutdownPrivilege and FATAL severity, triggers an immediate bugcheck (BSOD).
- NtSetInformationFile
Sets file metadata via FILE_INFORMATION_CLASS — rename, dispose (delete), allocate, end-of-file, etc.
- NtSetSystemPowerState
Transitions the system into the requested sleep, hibernate or working power state.
- NtInitiatePowerAction
Requests the power manager to perform a system-wide power action (sleep, hibernate, shutdown, reboot).
- NtShutdownSystem
Kernel-mode shutdown trigger — powers off, reboots or shuts down the system in one syscall.