Techniques › T1561.001 › AN0885
AN0885 Analytic 0885
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of CLI commands erasing file systems or storage (erase flash:, format disk, erase nvram:). Detect authentication events followed by destructive commands within the same privileged session.</p>
- Detects
- T1561.001 Disk Content Wipe
- Part of
- DET0316 Detection Strategy for Disk Content Wipe via Direct Access and Overwrite
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:cli | erase flash:, erase nvram:, format disk | DC0064 Command Execution |
| networkdevice:syslog | Privileged login followed by destructive command sequence | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PrivilegedUsers | Tune to exclude approved maintenance performed by authorized administrators. |
CommandPatterns | Expand or narrow destructive command coverage depending on vendor-specific syntax. |