Deleting a file leaves it recoverable. Overwriting the sectors does not. Disk Content Wipe (T1561.001) is an Impact technique for Linux, macOS, Windows and network devices. It is a subtechnique of Disk Wipe.
How attackers use it
MITRE describes adversaries erasing the contents of storage devices on specific systems or many systems in a network to interrupt availability. They may partially or completely overwrite a storage device so that data is irrecoverable through the storage interface. Rather than targeting specific disk structures or files, they wipe arbitrary portions of the disk, which MITRE says is distinct from Data Destruction because sections of the disk are erased and not individual files.
To do this they acquire direct access to the drive and overwrite sections with random data. MITRE notes adversaries have also been observed using third-party drivers such as RawDisk to reach disk content directly. As with other wipes, malware may spread through Valid Accounts, OS Credential Dumping and SMB or Windows Admin Shares.
How to detect it
MITRE's analytics, by platform:
- Windows. Processes attempting raw disk access through physical drive paths, abnormal file I/O to the MBR or boot sectors, and loading of third-party drivers such as RawDisk. Correlate process creation, privilege use and disk modification events within a short window.
- Linux. Destructive utilities such as dd, shred or wipe targeting block devices, or processes writing directly to /dev/sd or /dev/nvme partitions.
- macOS. diskutil or asr with destructive flags such as eraseDisk or zeroDisk, or low-level IOKit calls that overwrite raw content.
- Network devices. Commands that erase file systems or storage, such as erase flash or erase nvram, after a privileged authentication.
Sysmon is a useful source on Windows. Event ID 6 records driver loads and event ID 9 records raw disk reads, and both help with the driver and raw access signals.
How to reduce the risk
MITRE lists one mitigation: data backup. Maintain IT disaster recovery plans with regular backups, stored off system and protected from the ways adversaries get in and destroy them.
Backups are only as good as the last restore. Pick a representative system, restore it from backup to a clean machine, and time it.
Why wipes spread so quickly
MITRE points out that wiper malware may have worm-like features and spread using valid accounts, credential dumping and Windows admin shares. Those are the same ingredients as ordinary lateral movement. So the time between the first wipe and the hundredth can be short, and the only protection that matters is what you did before it started.
Three preparations pay off most.
- Isolated backups. Copies the wiper cannot reach with the credentials it steals.
- Segmentation. Fewer paths between systems, so a worm has fewer places to go.
- A rehearsed response. Who decides to cut network links, who calls whom, and where the clean images are.
Check your own environment
- Which of your backups are reachable from a domain-joined admin account? Those can be wiped by the same credentials that wiper malware may steal.
- When did you last test a full restore, not just a file restore?
- Do you alert on driver installs on servers, and on raw disk access by processes that are not backup or imaging tools?
A wipe is an incident, and an incident needs a plan. The demo below walks through how a team structures the response and the postmortem.
Click through it at your own pace, or open it full screen.
Quick check
How does disk content wipe differ from data destruction according to MITRE?
It overwrites sections of the disk directly, rather than deleting individual files.
