Disk Wipe
- ID
- T1561
- Tactics
- TA0040 Impact
- Platforms
- Linux, macOS, Windows, Network Devices
- Data sources
- User Account Metadata, Drive Modification, Driver Load, Drive Access, Process Creation, Command Execution, User Account Authentication
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.[2]
On network devices, adversaries may wipe configuration files and other data from the device using Network Device CLI commands such as erase.[3]
Sub-techniques (2)
Detection
- DET0137 Detection Strategy for Disk Wipe via Direct Disk Access and Destructive Commands
Data components: User Account Metadata, Drive Modification, Driver Load, Drive Access, Process Creation, Command Execution, User Account Authentication
Mitigations (1)
- M1053 Data Backup
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.[1] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
References
- Ready.gov IT DRP
- Novetta Blockbuster Destructive Malware
- erase_cmd_cisco