MITRE ATT&CK / Software / S0364

RawDisk

ID
S0364
Type
Tool
Platforms
Windows
Source
attack.mitre.org
MITRE last modified
18 Nov 2024

RawDisk is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.[1][2]

Techniques used (3)

Groups using it (1)

References

  1. EldoS RawDisk ITpro
  2. Novetta Blockbuster Destructive Malware