{"id":"T1561.002","name":"Disk Structure Wipe","url":"https://attack.mitre.org/techniques/T1561/002","tactics":["impact"],"platforms":["Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0297","stix_id":"x-mitre-detection-strategy--1dd8a02b-b447-48ed-a146-ad955c9b2dc1","name":"Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite","url":"https://attack.mitre.org/detectionstrategies/DET0297","analytics":[{"id":"AN0827","stix_id":"x-mitre-analytic--34560ac3-2e05-4394-8145-0cd6071c1680","name":"Analytic 0827","description":"Processes attempting raw disk access to overwrite sensitive structures such as the MBR or partition table using \\\\.\\PhysicalDrive notation. Detection relies on correlating process creation, privilege escalation, and raw sector writes in Sysmon and Security logs.","url":"https://attack.mitre.org/detectionstrategies/DET0297#AN0827","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4673","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"Raw write attempts targeting \\\\.\\PhysicalDrive0 or sector 0 (MBR/partition table)","data_component":"DC0046","data_component_name":"Drive Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=6","data_component":"DC0079","data_component_name":"Driver Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"SectorRange","description":"Specify which sectors are considered critical (MBR, partition table) to reduce noise."},{"field":"ProcessWhitelist","description":"Exclude legitimate low-level disk management or imaging tools used by administrators."}],"live":true,"detection_strategies":["DET0297"],"techniques":["T1561.002"]},{"id":"AN0828","stix_id":"x-mitre-analytic--538707d4-df45-489b-97f5-0115802a701f","name":"Analytic 0828","description":"Execution of utilities (dd, hdparm, sgdisk) or custom binaries attempting to overwrite disk boot structures (/dev/sda MBR sector or partition tables). Detection correlates shell execution with syscalls writing to sector 0 or disk metadata blocks.","url":"https://attack.mitre.org/detectionstrategies/DET0297#AN0828","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write syscalls to /dev/sd* targeting offset 0","data_component":"DC0054","data_component_name":"Drive Access","log_source_slug":"auditd-syscall"},{"name":"auditd:EXECVE","channel":"Execution of dd/sgdisk with arguments writing to sector 0 or partition table","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"}],"mutable_elements":[{"field":"TargetDevices","description":"Define specific device paths to monitor (e.g., /dev/sda, /dev/nvme0n1)."},{"field":"OffsetThreshold","description":"Focus on suspicious writes at disk offsets corresponding to MBR/partition structures."}],"live":true,"detection_strategies":["DET0297"],"techniques":["T1561.002"]},{"id":"AN0829","stix_id":"x-mitre-analytic--575a9c01-6dac-4513-86ca-e80b6e485212","name":"Analytic 0829","description":"Abnormal invocation of diskutil or asr that modifies partition tables or initializes raw devices. Monitor for IOKit system calls targeting disk headers or EFI boot sectors, correlated with elevated privileges.","url":"https://attack.mitre.org/detectionstrategies/DET0297#AN0829","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"diskutil partitionDisk or eraseVolume with partition scheme modifications","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"IOKit raw disk write to EFI/boot partition sectors","data_component":"DC0046","data_component_name":"Drive Modification","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AdminToolWhitelist","description":"System provisioning workflows may legitimately re-partition disks; whitelist by context."}],"live":true,"detection_strategies":["DET0297"],"techniques":["T1561.002"]},{"id":"AN0830","stix_id":"x-mitre-analytic--d970c6c7-82d0-4977-9e2e-4b27af383ca5","name":"Analytic 0830","description":"Execution of destructive CLI commands such as format flash:, format disk, or equivalent vendor-specific commands that erase filesystem structures. Detection correlates AAA logs showing privileged access with immediate format/erase commands.","url":"https://attack.mitre.org/detectionstrategies/DET0297#AN0830","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:cli","channel":"format flash:, format disk, reformat commands","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"},{"name":"networkdevice:syslog","channel":"Privileged login followed by destructive format command","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"CommandPatterns","description":"Expand detection to cover vendor-specific destructive commands."},{"field":"PrivilegedUsers","description":"Whitelist authorized maintenance sessions to reduce false positives."}],"live":true,"detection_strategies":["DET0297"],"techniques":["T1561.002"]}],"live":true,"version":"1.0","techniques":["T1561.002"]}],"sigma_rules":[{"id":"71d65515-c436-43c0-841b-236b1f32c21e","title":"Cisco File Deletion","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-12","modified":"2023-01-04","description":"See what files are being deleted from flash file systems","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.impact","attack.stealth","attack.t1070.004","attack.t1561.001","attack.t1561.002"],"path":"rules/network/cisco/aaa/cisco_cli_file_deletion.yml","techniques":["T1070.004","T1561.001","T1561.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}