T1561.002 — Disk Structure Wipe

Tactic: Impact · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by…

Sub-technique of Disk Wipe (T1561).

Sigma detection rules (4)

title: "T1561.002 Disk Wipe: Disk Structure Wipe"
id: bdc7e2ae-ed1f-4954-bf7a-0d6d1c3fc09e
description: 'Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite. (Data Component: Drive Modification; baseline tier: fallback.) Tune using: SectorRange, ProcessWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1561/002
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.impact
  - attack.t1561.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_diskpart:
    Image|endswith: '\\diskpart.exe'
    CommandLine|contains: 'clean'
  selection_rawwrite:
    CommandLine|contains: '\\\\.\\PhysicalDrive'

  condition: 1 of selection_*

falsepositives:
  - Disk provisioning or re-imaging workflows that legitimately run diskpart clean or write to raw disk devices during system deployment.

level: critical

title: "T1561.002 Disk Wipe: Disk Structure Wipe"
id: e53b0805-48cf-413a-9599-ae52461b3846
description: 'Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite using dd. Fixed an argv-position bug: if=/dev/zero and of=/dev/* are separate argv tokens in a real dd invocation and never co-occur in the same field, so the source and destination checks are now matched independently across a1-a3 rather than requiring both substrings in one token. Tune using: TargetDevices, OffsetThreshold.'
references:
  - https://attack.mitre.org/techniques/T1561/002
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.impact
  - attack.t1561.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_dd:
    type: EXECVE
    a0|endswith: '/dd'
  selection_zero_source:
    - a1|contains: 'if=/dev/zero'
    - a2|contains: 'if=/dev/zero'
    - a3|contains: 'if=/dev/zero'
  selection_disk_target:
    - a1|contains: 'of=/dev/sd'
    - a2|contains: 'of=/dev/sd'
    - a3|contains: 'of=/dev/sd'
    - a1|contains: 'of=/dev/nvme'
    - a2|contains: 'of=/dev/nvme'
    - a3|contains: 'of=/dev/nvme'
    - a1|contains: 'of=/dev/vd'
    - a2|contains: 'of=/dev/vd'
    - a3|contains: 'of=/dev/vd'

  condition: selection_dd and selection_zero_source and selection_disk_target

falsepositives:
  - Administrators zeroing a decommissioned disk or preparing a device image for redeployment.

level: critical

title: "T1561.002 Disk Wipe: Disk Structure Wipe"
id: 4bbd2c80-2f61-4e73-9bb7-f07f4193c14b
description: 'Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminToolWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1561/002
author: Shahrukh Khan
date: 2026-03-15
license: MIT
tags:
  - attack.impact
  - attack.t1561.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/diskutil'
    CommandLine|contains:
      - 'eraseVolume'
      - 'partitionDisk'
  selection2:
    Image|endswith: '/dd'
    CommandLine|contains|all:
      - 'if=/dev/zero'
      - 'of=/dev/disk'

  condition: 1 of selection*

falsepositives:
  - Legitimate disk repartitioning performed by system administrators using diskutil during an OS reinstall.

level: critical

title: "T1561.002 Disk Wipe: Disk Structure Wipe"
id: ca96cc4e-86ff-43f3-aa7c-1f8b6bf69204
description: 'Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite. Dropped the unconditional mkfs selector, which fired on any routine filesystem creation/formatting with no tie to destructive wiping. Constrained the dd selector to invocations specifying a small block/count value (bs=512 or count=1/2/34, consistent with overwriting only the MBR/GPT header sectors) rather than any if=/dev/zero of=/dev/sd invocation, which could also represent a full-device content wipe (T1561.001) rather than structure-only wipe. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CommandPatterns, PrivilegedUsers.'
references:
  - https://attack.mitre.org/techniques/T1561/002
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.impact
  - attack.t1561.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_dd:
    type: EXECVE
    a0|endswith: '/dd'
    a1|contains: 'if=/dev/zero'
    a2|contains: 'of=/dev/sd'
  selection_dd_small:
    - a3|contains:
        - 'bs=512'
        - 'count=1'
        - 'count=2'
        - 'count=34'
    - a4|contains:
        - 'bs=512'
        - 'count=1'
        - 'count=2'
        - 'count=34'
  selection_wipefs:
    type: EXECVE
    a0|endswith: '/wipefs'
  selection_shred_disk:
    type: EXECVE
    a0|endswith: '/shred'
    a1|contains: '/dev/sd'

  condition: (selection_dd and selection_dd_small) or selection_wipefs or selection_shred_disk

falsepositives:
  - Legitimate disk provisioning, secure decommissioning procedures, or formatting new storage volumes during system builds; wipefs is also used legitimately to clear signatures on a device being repurposed.

level: critical

Related sub-techniques

• T1561.001 Disk Content Wipe

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1561.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan