tfMITRE ATT&CK technique
Disk Wipe T1561
- Tactic
- Impact
- Platforms
- Linux, macOS, Windows, Network Devices
- Version
- 1.2
- Created
- 20 February 2020
- Last modified
- 24 October 2025
- Contributor
- Austin Clark, @c2defense
Sub-techniques 24 rules across the family · 0 mapped directly to T1561 · 2 of 2 carry rules
Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.