Techniques › T1561.002 › AN0828
AN0828 Analytic 0828
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of utilities (dd, hdparm, sgdisk) or custom binaries attempting to overwrite disk boot structures (/dev/sda MBR sector or partition tables). Detection correlates shell execution with syscalls writing to sector 0 or disk metadata blocks.</p>
- Detects
- T1561.002 Disk Structure Wipe
- Part of
- DET0297 Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | write syscalls to /dev/sd* targeting offset 0 | DC0054 Drive Access |
| auditd:EXECVE | Execution of dd/sgdisk with arguments writing to sector 0 or partition table | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetDevices | Define specific device paths to monitor (e.g., /dev/sda, /dev/nvme0n1). |
OffsetThreshold | Focus on suspicious writes at disk offsets corresponding to MBR/partition structures. |