T1561.001 — Disk Content Wipe

Tactic: Impact · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the…

Sub-technique of Disk Wipe (T1561).

Sigma detection rules (4)

title: "T1561.001 Disk Wipe: Disk Content Wipe"
id: cf0e9337-f289-4d72-aabf-cf118550e753
description: 'Detection Strategy for Disk Content Wipe via Direct Access and Overwrite. (Data Component: Drive Modification; baseline tier: fallback.) Tune using: ProcessWhitelist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1561/001
author: Shahrukh Khan
date: 2026-04-10
license: MIT
tags:
  - attack.impact
  - attack.t1561.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_cmd:
    CommandLine|contains:
      - 'cipher /w'
      - 'sdelete'
      - 'format '
      - '\\\\.\\PhysicalDrive'
  selection_image:
    Image|endswith:
      - '\\sdelete.exe'
      - '\\sdelete64.exe'

  condition: 1 of selection_*

falsepositives:
  - Administrators using cipher or sdelete for legitimate secure deletion of sensitive files during decommissioning.

level: high

title: "T1561.001 Disk Wipe: Disk Content Wipe"
id: df2262b3-6b0d-4e2d-8c22-b15236aa14fa
description: 'Detection Strategy for Disk Content Wipe via direct overwrite of raw block-device content (e.g. dd or shred writing zero/random data directly to a disk device), as distinct from Disk Structure Wipe (T1561.002) partition-table/filesystem-signature clearing tools such as wipefs, sgdisk, and parted, which are out of scope here and belong on a T1561.002 rule instead. Tune using: TargetDevices, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1561/001
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.impact
  - attack.t1561.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_dd:
    type: EXECVE
    a0|endswith: '/dd'
  selection_dd_target_a1:
    a1|contains: 'of=/dev/'
  selection_dd_target_a2:
    a2|contains: 'of=/dev/'
  selection_dd_target_a3:
    a3|contains: 'of=/dev/'
  selection_dd_source_a1:
    a1|contains:
      - 'if=/dev/zero'
      - 'if=/dev/urandom'
  selection_dd_source_a2:
    a2|contains:
      - 'if=/dev/zero'
      - 'if=/dev/urandom'
  selection_dd_source_a3:
    a3|contains:
      - 'if=/dev/zero'
      - 'if=/dev/urandom'
  selection_shred:
    type: EXECVE
    a0|endswith: '/shred'
  selection_shred_target_a1:
    a1|re: '^/dev/'
  selection_shred_target_a2:
    a2|re: '^/dev/'
  selection_shred_target_a3:
    a3|re: '^/dev/'
  condition: (selection_dd and 1 of selection_dd_target_* and 1 of selection_dd_source_*) or (selection_shred and 1 of selection_shred_target_*)

falsepositives:
  - Legitimate disk imaging, secure-erase before decommissioning, or storage benchmarking using dd/shred directly against block devices.

level: critical

title: "T1561.001 Disk Wipe: Disk Content Wipe"
id: d372e32d-7364-483f-a524-dbca8e5ecd04
description: 'Detection Strategy for Disk Content Wipe via Direct Access and Overwrite. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminToolWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1561/001
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.impact
  - attack.t1561.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/diskutil'
    CommandLine|contains: 'secureErase'
  selection2:
    Image|endswith: '/srm'

  condition: 1 of selection*

falsepositives:
  - Approved data sanitization procedures run by IT during asset retirement.

level: critical

title: "T1561.001 Disk Wipe: Disk Content Wipe"
id: 65a28958-5fb0-49f4-8493-e87defbb7ef3
description: 'Detection Strategy for Disk Content Wipe via Direct Access and Overwrite. (Data Component: Command Execution; baseline tier: fallback.) Tune using: PrivilegedUsers, CommandPatterns.'
references:
  - https://attack.mitre.org/techniques/T1561/001
author: Shahrukh Khan
date: 2026-04-25
license: MIT
tags:
  - attack.impact
  - attack.t1561.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_tools:
    type: EXECVE
    a0|endswith:
      - '/shred'
      - '/wipefs'
      - '/dd'
  selection_target:
    type: EXECVE
    a1|contains:
      - 'if=/dev/zero'
      - 'if=/dev/urandom'
      - '/dev/sd'
      - '/dev/nvme'

  condition: selection_tools and selection_target

falsepositives:
  - Legitimate secure-disposal or disk-sanitization procedures before decommissioning hardware use the same shred, wipefs, and dd invocations.

level: critical

Related sub-techniques

• T1561.002 Disk Structure Wipe

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1561.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan