Detecting and Mitigating Disk Wipe Attacks (T1561)

Some attacks are not about stealing anything. Disk Wipe (T1561) is about making systems unusable by overwriting the disk. MITRE lists it under Impact, for Linux, macOS, Windows and network devices.

How attackers use it

MITRE describes adversaries wiping or corrupting raw disk data on specific systems or on many systems across a network, to interrupt availability. With direct write access to a disk, they can overwrite portions of it, wipe structures such as the master boot record (MBR), or attempt to wipe every sector.

Where the goal is network-wide disruption, MITRE says wiper malware may have worm-like features and spread through Valid Accounts, OS Credential Dumping and SMB or Windows Admin Shares. On network devices, adversaries may wipe configuration files and other data with CLI commands such as erase.

The subtechniques are Disk Content Wipe and Disk Structure Wipe.

How to detect it

MITRE's analytics, by platform:

• Windows. Direct disk access with the physical drive path notation, abnormal writes to the MBR or boot sectors, and kernel drivers that grant raw disk access.
• Linux. Destructive commands such as dd, shred or wipe aimed at raw devices like /dev/sda, and direct writes to partitions or the bootloader.
• macOS. Unusual use of diskutil, asr or low-level IOKit calls to erase or partition drives.
• Network devices. Commands such as erase startup-config, erase flash or format disk, particularly after a privilege escalation.

Detection time is short. Treat any of these on a production system as an incident until proven otherwise.

How to reduce the risk

MITRE lists one mitigation: data backup. Have IT disaster recovery plans with procedures for regular backups that can restore organizational data. Store backups off the system, and protect them from the methods adversaries use to reach and destroy them. A backup the wiper can also reach is not a backup.

Quick check

Sources

• MITRE ATT&CK T1561: Disk Wipe