tfMITRE ATT&CK technique

Disk Wipe T1561

Tactic: Impact
Platforms: Linux, macOS, Windows, Network Devices
Version: 1.2
Created: 20 February 2020
Last modified: 24 October 2025
Contributor: Austin Clark, @c2defense

Sub-techniques 24 rules across the family · 0 mapped directly to T1561 · 2 of 2 carry rules

.001Disk Content Wipe2 .002Disk Structure Wipe3

Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1561

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Disk Wipe detection strategy DET0137

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Disk Wipe via Direct Disk Access and Destructive Commands

Enterprise

4 platforms

AN0384 · Windows

Unusual direct disk access attempts (e.g., use of \\.\PhysicalDrive notation), abnormal writes to MBR/boot sectors, and installation of kernel drivers that grant raw disk access. Correlate anomalous process creation with disk modification attempts and driver loads.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	WinEventLog:Security	EventCode=4673
Drive ModificationDC0046	WinEventLog:Sysmon	Raw disk write access via \\.\PhysicalDrive* or \\.\C:
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessWhitelist	Legitimate disk imaging or backup tools may trigger raw disk access — must be excluded per environment.
TimeWindow	Correlate disk access, driver load, and process execution within a short timeframe to minimize false positives.

AN0385 · Linux

Processes invoking destructive commands (dd, shred, wipe) with raw device targets (e.g., /dev/sda, /dev/nvme0n1). Detect direct writes to disk partitions and abnormal superblock or bootloader modifications. Correlate shell execution with subsequent block device I/O.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	Execution of dd, shred, wipe targeting block devices
Drive AccessDC0054	auditd:SYSCALL	open/write syscalls on /dev/sd* or /dev/nvme*

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDevices	Tune to exclude removable drives or test partitions commonly written by administrators.
EntropyThreshold	Detects large blocks of pseudorandom data being written; may need tuning for backup/crypto workloads.

AN0386 · macOS

Abnormal invocation of diskutil, asr, or low-level APIs (IOKit) to erase/partition drives. Correlate process execution with unified log entries showing destructive disk operations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive ModificationDC0046	macos:unifiedlog	IOKit disk write calls targeting raw devices
Command ExecutionDC0064	macos:unifiedlog	diskutil eraseDisk / asr restore with destructive flags

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AdminToolWhitelist	System administrators may legitimately use diskutil/asr for provisioning — whitelist by user or context.

AN0387 · Network Devices

Execution of destructive CLI commands such as 'erase startup-config', 'erase flash:' or 'format disk' on routers/switches. Detect privilege level escalation preceding destructive commands.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	networkdevice:syslog	User privilege escalation to level 15/root prior to destructive commands
Command ExecutionDC0064	networkdevice:cli	erase flash:, erase startup-config, format disk

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegedUsers	Tune to exclude approved maintenance sessions by known administrators.
CommandPatterns	Adjust monitored destructive command list depending on device vendor and OS.

Disk Wipe detections T1561

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs