Techniques › T1561 › T1561.002
T1561.002 Disk Structure Wipe
impact — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
1
Sigma rules tagged attack.t1561.002
0
KEV CVEs mapped here
<p>Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.</p><p>Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table. The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. Disk Structure Wipe may be performed in isolation, or along with Disk Content Wipe if all sectors of a disk are wiped.</p><p>On a network devices, adversaries may reformat the file system using Network Device CLI commands such as
format.</p><p>To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0297 Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite v1.0
AN0827 WindowsProcesses attempting raw disk access to overwrite sensitive structures such as the MBR or partition table using \\.\PhysicalDrive notation. Detection relies on correlating process creation, privilege escalation, and raw sector writes in Sysmon and Security logs.WinEventLog:Sysmon
Raw write attempts targeting \\.\PhysicalDrive0 or sector 0 (MBR/partition table)→ DC0046 Drive ModificationTunable:SectorRangeProcessWhitelistAN0828 LinuxExecution of utilities (dd, hdparm, sgdisk) or custom binaries attempting to overwrite disk boot structures (/dev/sda MBR sector or partition tables). Detection correlates shell execution with syscalls writing to sector 0 or disk metadata blocks.auditd:EXECVEExecution of dd/sgdisk with arguments writing to sector 0 or partition table→ DC0032 Process CreationTunable:TargetDevicesOffsetThresholdAN0829 macOSAbnormal invocation of diskutil or asr that modifies partition tables or initializes raw devices. Monitor for IOKit system calls targeting disk headers or EFI boot sectors, correlated with elevated privileges.macos:unifiedlogdiskutil partitionDisk or eraseVolume with partition scheme modifications→ DC0064 Command ExecutionTunable:AdminToolWhitelistAN0830 Network DevicesExecution of destructive CLI commands such as format flash:, format disk, or equivalent vendor-specific commands that erase filesystem structures. Detection correlates AAA logs showing privileged access with immediate format/erase commands.networkdevice:syslogPrivileged login followed by destructive format command→ DC0002 User Account AuthenticationTunable:CommandPatternsPrivilegedUsers
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1561.002
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 71d65515-c436-43c0-841b-236b1f32c21e
See what files are being deleted from flash file systems