A computer that cannot find its boot code is just a box. Disk Structure Wipe (T1561.002) targets that. MITRE lists it under Impact, for Linux, macOS, Windows and network devices. It is a subtechnique of Disk Wipe.
How attackers use it
MITRE describes adversaries corrupting or wiping the data structures on a drive that are needed to boot a system, on specific critical systems or on many at once. They may overwrite the master boot record (MBR) or the partition table. These hold the initial executable code that loads the operating system and the location of the file system partitions. Without them, the computer cannot load an OS during boot and is unavailable.
The wipe may be done alone, or together with Disk Content Wipe if all sectors are wiped. On network devices, MITRE says adversaries may reformat the file system with CLI commands such as format. As with other wipes, malware may spread through Valid Accounts, OS Credential Dumping and SMB or Windows Admin Shares.
How to detect it
MITRE's analytics:
- Windows. Processes attempting raw disk access to overwrite the MBR or partition table. Correlate process creation, privilege escalation and raw sector writes in Sysmon and Security logs.
- Linux. dd, hdparm, sgdisk or custom binaries overwriting boot structures such as the MBR sector or partition tables, correlated with shell execution.
- macOS. diskutil or asr modifying partition tables or initializing raw devices, and IOKit calls targeting disk headers or EFI boot sectors.
- Network devices. Commands such as format flash or format disk, correlated with AAA logs that show privileged access.
How to reduce the risk
MITRE lists one mitigation: data backup. Keep IT disaster recovery plans with regular backups, store them off system, and protect them from adversaries.
Add a boot recovery step to the plan, because a system with a wiped MBR needs more than file restores. Keep known-good images and the means to deploy them.
Quick check
Which two structures does MITRE call out as targets?
The master boot record and the partition table.
