VOID MANTICOREG1055 ↗
Has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.1
- Tactic
- Impact
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.2
- Created
- 20 February 2020
- Last modified
- 12 May 2026
- Contributor
- Austin Clark, @c2defense
Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.13
Tools & malwareTop 23%
Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.Disk Structure Wipe MITRE reference T1561.002
Top 25%of all ATT&CK techniques for number of groups
6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Ember BearG1003 ↗
Conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.1
APT38G0082 ↗
Has used a custom MBR wiper named BOOTWRECK to render systems inoperable.1
APT37G0067 ↗
Has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).12
Sandworm TeamG0034 ↗
Has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.12
Lazarus GroupG0032 ↗
Malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.12
All 6 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.12
All 1 campaigns for this technique
13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
DiskpartS9002 ↗
Can be used to delete a partition or a volume.1 Diskpart can also be used to remove all partitions or volume formatting from the selected disk.2
ShrinkLockerS1178 ↗
ZeroCleareS1151 ↗
Can corrupt the file system and wipe the system drive on targeted hosts.123
BFG AgonizerS1136 ↗
Retrieves a device handle to \\\\.\\PhysicalDrive0 to wipe the boot sector of a given disk.1
MultiLayer WiperS1135 ↗
Opens a handle to \\\\\\\\.\\\\PhysicalDrive0 and wipes the first 512 bytes of data from this location, removing the boot sector.1
DEADWOODS1134 ↗
Opens and writes zeroes to the first 512 bytes of each drive, deleting the MBR. DEADWOOD then sends the control code IOCTL_DISK_DELETE_DRIVE_LAYOUT to ensure the MBR is removed from the drive.1
All 13 software entries for this technique · 6 newest in this preview
Offense vs defense T1561.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 2
first rule: 2019 Q3 · 1 of 1 campaigns plottedDisk Structure Wipe detection strategy DET0297
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite
4 platforms
AN0827 · Windows
Processes attempting raw disk access to overwrite sensitive structures such as the MBR or partition table using \\.\PhysicalDrive notation. Detection relies on correlating process creation, privilege escalation, and raw sector writes in Sysmon and Security logs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account MetadataDC0013 | WinEventLog:Security | EventCode=4673 |
| Drive ModificationDC0046 | WinEventLog:Sysmon | Raw write attempts targeting \\.\PhysicalDrive0 or sector 0 (MBR/partition table) |
| Driver LoadDC0079 | WinEventLog:Sysmon | EventCode=6 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SectorRange | Specify which sectors are considered critical (MBR, partition table) to reduce noise. |
| ProcessWhitelist | Exclude legitimate low-level disk management or imaging tools used by administrators. |
AN0828 · Linux
Execution of utilities (dd, hdparm, sgdisk) or custom binaries attempting to overwrite disk boot structures (/dev/sda MBR sector or partition tables). Detection correlates shell execution with syscalls writing to sector 0 or disk metadata blocks.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | Execution of dd/sgdisk with arguments writing to sector 0 or partition table |
| Drive AccessDC0054 | auditd:SYSCALL | write syscalls to /dev/sd* targeting offset 0 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetDevices | Define specific device paths to monitor (e.g., /dev/sda, /dev/nvme0n1). |
| OffsetThreshold | Focus on suspicious writes at disk offsets corresponding to MBR/partition structures. |
AN0829 · macOS
Abnormal invocation of diskutil or asr that modifies partition tables or initializes raw devices. Monitor for IOKit system calls targeting disk headers or EFI boot sectors, correlated with elevated privileges.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Drive ModificationDC0046 | macos:unifiedlog | IOKit raw disk write to EFI/boot partition sectors |
| Command ExecutionDC0064 | macos:unifiedlog | diskutil partitionDisk or eraseVolume with partition scheme modifications |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AdminToolWhitelist | System provisioning workflows may legitimately re-partition disks; whitelist by context. |
AN0830 · Network Devices
Execution of destructive CLI commands such as format flash:, format disk, or equivalent vendor-specific commands that erase filesystem structures. Detection correlates AAA logs showing privileged access with immediate format/erase commands.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | Privileged login followed by destructive format command |
| Command ExecutionDC0064 | networkdevice:cli | format flash:, format disk, reformat commands |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandPatterns | Expand detection to cover vendor-specific destructive commands. |
| PrivilegedUsers | Whitelist authorized maintenance sessions to reduce false positives. |
Data BackupM1053
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.