Techniques › T1561.002 › AN0827
AN0827 Analytic 0827
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Processes attempting raw disk access to overwrite sensitive structures such as the MBR or partition table using \\.\PhysicalDrive notation. Detection relies on correlating process creation, privilege escalation, and raw sector writes in Sysmon and Security logs.</p>
- Detects
- T1561.002 Disk Structure Wipe
- Part of
- DET0297 Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4673 | DC0013 User Account Metadata |
| WinEventLog:Sysmon | Raw write attempts targeting \\.\PhysicalDrive0 or sector 0 (MBR/partition table) | DC0046 Drive Modification |
| WinEventLog:Sysmon | EventCode=6 | DC0079 Driver Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SectorRange | Specify which sectors are considered critical (MBR, partition table) to reduce noise. |
ProcessWhitelist | Exclude legitimate low-level disk management or imaging tools used by administrators. |