T1561No distinct observable

Disk Wipe

ImpactLinux, macOS, Windows, Network Devices

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The parent brief carries no observable its two children do not already own. DET0137's three analytics are a near-verbatim union of the children's: AN0384 (Windows) states the same '\\.\PhysicalDrive access, MBR/boot-sector writes, raw-disk driver load' behaviour over the same two log sources — Security 4673 and Sysmon EventID 6 driver_load — as AN0882 in T1561.001 and AN0827 in T1561.002, down to the ProcessWhitelist and TimeWindow knobs; AN0385 (Linux, dd/shred/wipe against /dev/sd* and /dev/nvme*) is AN0883 with 'sgdisk' dropped; AN0386 (macOS, diskutil eraseDisk / asr) is AN0884. Any rule written here would be a third copy of a child rule under a tag that does not describe the behaviour any better. […]

Covered instead by T1561.001, T1561.002.

What the technique is

Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares. On network devices, adversaries may wipe configuration files and other data from the device using Network Device CLI commands such as erase.

Read it on attack.mitre.org

What MITRE says you would watch

AN0384
Unusual direct disk access attempts (e.g., use of \\.\PhysicalDrive notation), abnormal writes to MBR/boot sectors, and installation of kernel drivers that grant raw disk access. Correlate anomalous process creation with disk modification attempts and driver loads.
AN0385
Processes invoking destructive commands (dd, shred, wipe) with raw device targets (e.g., /dev/sda, /dev/nvme0n1). Detect direct writes to disk partitions and abnormal superblock or bootloader modifications. Correlate shell execution with subsequent block device I/O.
AN0386
Abnormal invocation of diskutil, asr, or low-level APIs (IOKit) to erase/partition drives. Correlate process execution with unified log entries showing destructive disk operations.