Cross-source coverage

T1561.001 / ATT&CK

Disk Wipe: Disk Content Wipe

6 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface. Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data. Adversaries have also been observed leveraging third-party drivers like RawDisk to directly access disk content. This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.

To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.

Tactics
Impact
Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:EXECVEmacos:unifiedlognetworkdevice:clinetworkdevice:syslog

How MITRE says to detect it DET0316

Detection Strategy for Disk Content Wipe via Direct Access and Overwrite

Windows Analytic 0882

Processes attempting raw disk access via \\.\PhysicalDrive paths, abnormal file I/O to MBR/boot sectors, or loading of third-party drivers (e.g., RawDisk) that enable disk overwrite. Correlate process creation, privilege usage, and disk modification events within a short time window.

  • WinEventLog:Security EventCode=4673
  • WinEventLog:Sysmon Raw disk writes targeting \\.\PhysicalDrive* or MBR locations
  • WinEventLog:Sysmon EventCode=6

Linux Analytic 0883

Execution of destructive utilities (dd, shred, wipe) targeting block devices, or processes invoking syscalls to directly overwrite /dev/sd* or /dev/nvme* partitions. Correlate abnormal file write attempts with shell process execution and block device access.

  • auditd:SYSCALL open/write syscalls to block devices (/dev/sd*, /dev/nvme*)
  • auditd:EXECVE Execution of dd, shred, or wipe with arguments targeting block devices

macOS Analytic 0884

Abnormal invocation of diskutil or asr with destructive flags (eraseDisk, zeroDisk), or low-level IOKit calls that overwrite raw disk content. Detect correlation between elevated process execution and disk erase operations.

  • macos:unifiedlog diskutil eraseDisk/zeroDisk or asr restore with destructive flags
  • macos:unifiedlog IOKit raw disk write activity targeting physical devices

Network Devices Analytic 0885

Execution of CLI commands erasing file systems or storage (erase flash:, format disk, erase nvram:). Detect authentication events followed by destructive commands within the same privileged session.

  • networkdevice:cli erase flash:, erase nvram:, format disk
  • networkdevice:syslog Privileged login followed by destructive command sequence

View on attack.mitre.org ↗

Wazuh Core Ruleset

4 rules
Detection Severity Format
Docker: Container deleted · docker.status = delete Medium Wazuh XML
Docker: Volume destroyed in · docker.Action = destroy Medium Wazuh XML
Docker: Container destroyed · docker.status = destroy Low Wazuh XML
PHP internal error (server out of space). Low Wazuh XML

SigmaHQ/sigma

1 rule
Detection Severity Format
Cisco File Deletion Medium Sigma

splunk/security_content

1 rule
Detection Severity Format
Microsoft Intune Bulk Wipe Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.