Cross-source coverage

T1561.002 / ATT&CK

Disk Wipe: Disk Structure Wipe

3 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table. The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. Disk Structure Wipe may be performed in isolation, or along with Disk Content Wipe if all sectors of a disk are wiped.

On a network devices, adversaries may reformat the file system using Network Device CLI commands such as format.

To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.

Tactics
Impact
Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:EXECVEmacos:unifiedlognetworkdevice:clinetworkdevice:syslog

How MITRE says to detect it DET0297

Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite

Windows Analytic 0827

Processes attempting raw disk access to overwrite sensitive structures such as the MBR or partition table using \\.\PhysicalDrive notation. Detection relies on correlating process creation, privilege escalation, and raw sector writes in Sysmon and Security logs.

  • WinEventLog:Security EventCode=4673
  • WinEventLog:Sysmon Raw write attempts targeting \\.\PhysicalDrive0 or sector 0 (MBR/partition table)
  • WinEventLog:Sysmon EventCode=6

Linux Analytic 0828

Execution of utilities (dd, hdparm, sgdisk) or custom binaries attempting to overwrite disk boot structures (/dev/sda MBR sector or partition tables). Detection correlates shell execution with syscalls writing to sector 0 or disk metadata blocks.

  • auditd:SYSCALL write syscalls to /dev/sd* targeting offset 0
  • auditd:EXECVE Execution of dd/sgdisk with arguments writing to sector 0 or partition table

macOS Analytic 0829

Abnormal invocation of diskutil or asr that modifies partition tables or initializes raw devices. Monitor for IOKit system calls targeting disk headers or EFI boot sectors, correlated with elevated privileges.

  • macos:unifiedlog diskutil partitionDisk or eraseVolume with partition scheme modifications
  • macos:unifiedlog IOKit raw disk write to EFI/boot partition sectors

Network Devices Analytic 0830

Execution of destructive CLI commands such as format flash:, format disk, or equivalent vendor-specific commands that erase filesystem structures. Detection correlates AAA logs showing privileged access with immediate format/erase commands.

  • networkdevice:cli format flash:, format disk, reformat commands
  • networkdevice:syslog Privileged login followed by destructive format command

View on attack.mitre.org ↗

splunk/security_content

2 rules
Detection Severity Format
Windows Raw Access To Disk Volume Partition Undefined SPL
Windows Raw Access To Master Boot Record Drive Undefined SPL

SigmaHQ/sigma

1 rule
Detection Severity Format
Cisco File Deletion Medium Sigma

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.