Techniques › T1561
T1561 Disk Wipe
impact — Linux, macOS, Windows, Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1561
0
KEV CVEs mapped here
<p>Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.</p><p>To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.</p><p>On network devices, adversaries may wipe configuration files and other data from the device using Network Device CLI commands such as
erase.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0137 Detection Strategy for Disk Wipe via Direct Disk Access and Destructive Commands v1.0
AN0384 WindowsUnusual direct disk access attempts (e.g., use of \\.\PhysicalDrive notation), abnormal writes to MBR/boot sectors, and installation of kernel drivers that grant raw disk access. Correlate anomalous process creation with disk modification attempts and driver loads.WinEventLog:Sysmon
Raw disk write access via \\.\PhysicalDrive* or \\.\C:→ DC0046 Drive ModificationTunable:ProcessWhitelistTimeWindowAN0385 LinuxProcesses invoking destructive commands (dd, shred, wipe) with raw device targets (e.g., /dev/sda, /dev/nvme0n1). Detect direct writes to disk partitions and abnormal superblock or bootloader modifications. Correlate shell execution with subsequent block device I/O.Tunable:TargetDevicesEntropyThresholdAN0386 macOSAbnormal invocation of diskutil, asr, or low-level APIs (IOKit) to erase/partition drives. Correlate process execution with unified log entries showing destructive disk operations.Tunable:AdminToolWhitelistAN0387 Network DevicesExecution of destructive CLI commands such as 'erase startup-config', 'erase flash:' or 'format disk' on routers/switches. Detect privilege level escalation preceding destructive commands.networkdevice:syslogUser privilege escalation to level 15/root prior to destructive commands→ DC0002 User Account AuthenticationTunable:PrivilegedUsersCommandPatterns
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1561
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.