VOID MANTICOREG1055 ↗
Has utilized a disk wiping utility to facilitate destructive actions on victim servers.1 VOID MANTICORE has also utilized legitimate remote disk wiping commands.2
- Tactic
- Impact
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.2
- Created
- 20 February 2020
- Last modified
- 12 May 2026
Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.13
Tools & malwareTop 23%
Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Disk Content Wipe MITRE reference T1561.001
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Gamaredon GroupG0047 ↗
Has used tools to delete files and folders from victims' desktops and profiles.1
Lazarus GroupG0032 ↗
Has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.1
All 3 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 used the native Microsoft utility cipher.exe to securely wipe files and folders – overwriting the deleted data using cmd.exe /c cipher /W:C.1
All 1 campaigns for this technique
13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
cipher.exeS1205 ↗
Can be used to overwrite deleted data in specified folders.1
AcidPourS1167 ↗
Includes functionality to overwrite victim devices with the content of a buffer to wipe disk content.1
DEADWOODS1134 ↗
Deletes files following overwriting them with random data.1
ApostleS1133 ↗
Searches for files on available drives based on a list of extensions hard-coded into the sample for follow-on wipe activity.1
AcidRainS1125 ↗
Iterates over device file identifiers on the target, opens the device file, and either overwrites the file or calls various IOCTLS commands to erase it.1
DarkGateS1111 ↗
Has deleted all files in the Mozilla directory using the following command: /c del /q /f /s C:\Users\User\AppData\Roaming\Mozilla\firefox*.1
All 13 software entries for this technique · 6 newest in this preview
Offense vs defense T1561.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2019 Q3 · 1 of 1 campaigns plottedDisk Content Wipe detection strategy DET0316
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Disk Content Wipe via Direct Access and Overwrite
4 platforms
AN0882 · Windows
Processes attempting raw disk access via \\.\PhysicalDrive paths, abnormal file I/O to MBR/boot sectors, or loading of third-party drivers (e.g., RawDisk) that enable disk overwrite. Correlate process creation, privilege usage, and disk modification events within a short time window.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account MetadataDC0013 | WinEventLog:Security | EventCode=4673 |
| Drive ModificationDC0046 | WinEventLog:Sysmon | Raw disk writes targeting \\.\PhysicalDrive* or MBR locations |
| Driver LoadDC0079 | WinEventLog:Sysmon | EventCode=6 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessWhitelist | Backup, forensics, or imaging tools may perform legitimate raw disk access — requires tuning per environment. |
| TimeWindow | Correlation threshold for process execution, driver load, and raw disk writes. |
AN0883 · Linux
Execution of destructive utilities (dd, shred, wipe) targeting block devices, or processes invoking syscalls to directly overwrite /dev/sd* or /dev/nvme* partitions. Correlate abnormal file write attempts with shell process execution and block device access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | Execution of dd, shred, or wipe with arguments targeting block devices |
| Drive AccessDC0054 | auditd:SYSCALL | open/write syscalls to block devices (/dev/sd*, /dev/nvme*) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetDevices | Exclude removable drives or designated partitions that may be overwritten during maintenance. |
| EntropyThreshold | Tune detection for pseudorandom write patterns to reduce false positives during high-volume I/O. |
AN0884 · macOS
Abnormal invocation of diskutil or asr with destructive flags (eraseDisk, zeroDisk), or low-level IOKit calls that overwrite raw disk content. Detect correlation between elevated process execution and disk erase operations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Drive ModificationDC0046 | macos:unifiedlog | IOKit raw disk write activity targeting physical devices |
| Command ExecutionDC0064 | macos:unifiedlog | diskutil eraseDisk/zeroDisk or asr restore with destructive flags |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AdminToolWhitelist | Provisioning workflows may legitimately use diskutil/asr — whitelist by user or system context. |
AN0885 · Network Devices
Execution of CLI commands erasing file systems or storage (erase flash:, format disk, erase nvram:). Detect authentication events followed by destructive commands within the same privileged session.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | Privileged login followed by destructive command sequence |
| Command ExecutionDC0064 | networkdevice:cli | erase flash:, erase nvram:, format disk |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PrivilegedUsers | Tune to exclude approved maintenance performed by authorized administrators. |
| CommandPatterns | Expand or narrow destructive command coverage depending on vendor-specific syntax. |
Data BackupM1053
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.