tool

RawDisk S0364

Type: tool
Platform: Windows
Created: 25 March 2019
Last modified: 17 November 2024

RawDisk is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.[1][2]

TechniquesBottom 12%

TacticBottom 6%

Threat groupunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0364

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	8b4e3d62-f743-11ee-9f6e-acde48001123
	Detects when a EFS Fileshare Mount is modified or deleted. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Austin Songer @austinsonger	2021-08-15	2022-10-09	6a7ba45c-63d8-473e-9736-2eaabff79964
	Identifies when an EKS cluster is created or deleted.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	low	Austin Songer	2021-08-16	2022-10-09	33d50d03-20ec-4b74-a74e-1e65a38af1c0
	Detects when a Container Registry is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	93e0ef48-37c8-49ed-a02c-038aab23628e
	Identifies when a device or device configuration in azure is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Data Manipulation Stored Data Manipulation	-	medium	Austin Songer @austinsonger	2021-09-03	2022-10-09	46530378-f9db-4af9-a9e5-889c177d3881
	Detects when a Azure Kubernetes Cluster is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	9541f321-7cba-4b43-80fc-fbd1fb922808
	Identifies when a Azure Kubernetes network policy is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	08d6ac24-c927-4469-b3b7-2e422d6e3c43
	Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	25cb259b-bbdc-4b87-98b7-90d7c72f8743
	Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	7ee0b4aa-d8d4-4088-b661-20efdf41a04c
	Identifies when ClusterRoles/Roles are being modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	818fee0c-e0ec-4e45-824e-83e4817b0887
	Identifies when a service account is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Account Access Removal Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	12d027c3-b48c-4d9d-8bb6-a732200034b2
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk	The following analytic detects modifications to files with extensions commonly associated with ransomware. (...)	Generic	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick	2019-10-16	2026-09-22	a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
Splunk	The following analytic detects the creation of files with names commonly associated with ransomware notes. (...)	Hunting	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	David Dorsey, Splunk	2019-10-16	2026-07-02	ada0f478-84a8-4641-a3f1-d82362d6bd71	-
	Detects potential overwriting and deletion of a file using DD.	Generic	test	process_creation	linux	Sysmon	Impact Data Destruction	-	low	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2022-07-07	2953194b-e33c-4859-b9e8-05948c167447
	Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Data Destruction	-	medium	frack113	2021-12-26	2023-02-21	4b046706-5789-4673-b111-66f25fe99534
Splunk	This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. (...)	Anomaly	experimental	dns	windows	Sysmon	Impact Data Destruction	-	medium	Jose Hernandez, Splunk	2025-02-12	2026-05-13	2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e
Splunk	This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. (...)	Anomaly	experimental	webserver	-	AWS	Impact Data Destruction	-	medium	Jose Hernandez, Splunk	2025-02-12	2026-05-13	3a1d8f62-5b9c-4e7d-b8f3-9d6a8e2f5e1f
Splunk	The following analytic detects excessive file deletion events in the Windows Defender folder. (...)	Generic	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk, Steven Dick	2022-01-21	2026-05-13	b5baa09a-7a05-11ec-8da4-acde48001122
	Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Data Destruction Stealth Indicator Removal	-	high	Ecco, E.M. Anhaus, oscd.community	2019-09-26	2023-09-09	add64136-62e5-48ea-807e-88638d02df1e
Splunk	The following analytic detects when a user removes an organization from GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	94cb89aa-aec1-4585-91b1-affcdacf357e
Splunk	The following analytic detects when a repository is archived in GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	8367cb99-bae1-4748-ae3b-0927bb381424
Splunk	The following analytic detects when a user deletes a repository in GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	f709e736-3e6c-492f-b865-bc7696cc24a7
Splunk	The following analytic detects when a repository is archived in GitHub Organizations. (...)	Anomaly	stable	cloud_audit	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	4f568a0e-896f-4d94-a2f7-fa6d82ab1f77
Splunk	The following analytic identifies when a repository is deleted within a GitHub organization. (...)	Anomaly	stable	cloud_audit	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71
Splunk	The following analytic detects the deletion of SSH keys on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	73a56508-1cf5-4df7-b8d9-5737fbdc27d2
Splunk	The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. (...)	Generic	stable	process_creation	linux	Linux Auditd	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2023-02-08	2026-05-13	4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c
Splunk	The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. (...)	Generic	stable	process_creation	linux	Linux Auditd	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-10-02	d1b74420-4cea-4752-a123-9b40dfcca49a
Splunk	The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. (...)	Generic	stable	process_creation	linux	Linux Auditd	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	ce2bde4d-a1d4-4452-8c87-98440e5adfb3
Splunk	The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. (...)	Anomaly	stable	process_creation	linux	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2023-02-08	2026-09-01	b11d3979-b2f7-411b-bb1a-bd00e642173b
Splunk	The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. (...)	Generic	stable	process_creation	linux	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2022-02-15	2026-10-02	9b6aae5e-8d85-11ec-b2ae-acde48001122
Splunk	The following analytic detects the deletion of critical directories on a Linux machine using the `rm` command with argument rf. (...)	Generic	stable	process_creation	linux	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2022-04-26	2026-05-13	33f89303-cc6f-49ad-921d-2eaea38a6f7a
Splunk	The following analytic detects the deletion of cron jobs on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	3b132a71-9335-4f33-9932-00bb4f6ac7e8
Splunk	The following analytic detects the deletion of init daemon scripts on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	729aab57-d26f-4156-b97f-ab8dda8f44b1
Splunk	The following analytic detects the deletion of services on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	b509bbd3-0331-4aaa-8e4a-d2affe100af6
Splunk	The following analytic detects the deletion of SSL certificates on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	839ab790-a60a-4f81-bfb3-02567063f615
Splunk	The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	e27fbc5d-0445-4c4a-bc39-87f060d5c602
Splunk	The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	9d867448-2aff-4d07-876c-89409a752ff8
Splunk	The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. (...)	Generic	stable	process_creation	linux	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2022-04-26	2026-05-13	c1952cf1-643c-4965-82de-11c067cbae76
	Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.	Generic	test	-	-	Azure Threat Management · Microsoft 365	Impact Data Destruction	-	medium	austinsonger	2021-08-19	2022-10-09	78a34b67-3c39-4886-8fb4-61c46dc18ecd
Splunk	The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default). (...)	Generic	stable	cloud_audit	-	Azure	Impact Disk Wipe Disk Content Wipe	-	medium	Jake Enea	2026-04-15	2026-05-13	c3f48aa9-878e-443f-8889-e42a11a9bea9
	Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".	Generic	experimental	-	windows	WinEventLog Application	Impact Data Destruction	-	medium	Daniel Degasperi '@d4ns4n_'	2025-06-04	—	00321fee-ca72-4cce-b011-5415af3b9960
Splunk	The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). (...)	Anomaly	stable	cloud_audit	-	Microsoft 365	Impact Data Destruction Stealth Indicator Removal Clear Mailbox Data	-	medium	Steven Dick	2025-01-23	2026-05-13	c7fe0949-348a-41ce-8f17-a09a7fe5fd7d
Splunk	The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. (...)	Generic	stable	email	-	Microsoft 365	Impact Data Destruction Collection Email Collection Local Email Collection Stealth Indicator Removal Clear Mailbox Data	-	medium	Steven Dick	2025-01-23	2026-09-23	e36de71a-6bdc-4002-98ff-e3e51b0d8f96
Splunk	The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. (...)	Anomaly	stable	email	-	Microsoft 365	Impact Data Destruction Collection Email Collection Local Email Collection Stealth Indicator Removal Clear Mailbox Data	-	medium	Steven Dick	2025-01-23	2026-09-23	b66aeaa4-586f-428b-8a2b-c4fd3039d8d3
Splunk	The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). (...)	Anomaly	stable	email	-	Microsoft 365	Impact Data Destruction Collection Email Collection Local Email Collection Stealth Indicator Removal Clear Mailbox Data	-	medium	Steven Dick	2025-01-23	2026-09-23	dd7798cf-c4f5-4114-ad0f-beacd9a33708
Splunk	The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). (...)	Anomaly	stable	cloud_audit	-	Microsoft 365	Impact Data Destruction Collection Email Collection Local Email Collection Stealth Indicator Removal Clear Mailbox Data	-	medium	Steven Dick	2025-01-23	2026-05-13	c97b3d72-0a47-46f9-b742-b89f1cc2d551
Splunk	The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). (...)	Anomaly	stable	email	-	Microsoft 365	Impact Data Destruction Stealth Indicator Removal Clear Mailbox Data	-	medium	Steven Dick	2025-01-23	2026-09-23	70a050a2-8537-488a-a628-b60a9558d96a
	Detects overwriting (effectively wiping/deleting) of a file.	Generic	stable	process_creation	linux	Linux Auditd	Impact Data Destruction	-	low	Jakob Weinzettl, oscd.community	2019-10-23	—	37222991-11e9-4b6d-8bdf-60fbe48f753e
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be

Title

Description

RawDisk S0364

RawDisk S0364

RawDisk MITRE reference S0364

Standing S0364

Reach

Coverage

RawDisk detections S0364