Detect Disk Structure Wipe in Google Chronicle
Adversaries may corrupt or wipe disk data structures such as the Master Boot Record (MBR), GUID Partition Table (GPT), or partition entries to render systems permanently unbootable. Wiper malware (Shamoon, HermeticWiper, WhisperGate, CaddyWiper, KillDisk) achieves this by opening a handle to raw physical disk devices (e.g., \\.\PhysicalDrive0) and overwriting the first 512 bytes (MBR boot sector) or subsequent partition structures. Some malware uses kernel-mode drivers such as ElRawDisk.sys (Shamoon) or the HermeticWiper EaseUS driver to bypass user-mode restrictions and gain direct disk sector access. On Linux systems, adversaries use utilities like dd with /dev/zero or /dev/urandom targeting /dev/sda or /dev/nvme0n1. This technique is frequently combined with worm-like propagation via SMB/Windows Admin Shares, Valid Accounts, and OS Credential Dumping to maximize organizational impact.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1561 Disk Wipe
- Sub-technique
- T1561.002 Disk Structure Wipe
- Canonical reference
- https://attack.mitre.org/techniques/T1561/002/
YARA-L Detection Query
rule t1561_002_disk_structure_wipe {
meta:
author = "Argus Detection Engineering"
description = "Detects disk structure wipe activity (T1561.002) including raw PhysicalDrive handle access, dd.exe/diskpart wiper tool commands, known wiper driver drops to user-writable paths, wiper kernel driver loads, and kernel mode driver service installations from non-system paths. Covers Shamoon (ElRawDisk), HermeticWiper (epmntdrv/EaseUS driver), WhisperGate, CaddyWiper, and KillDisk."
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1561.002"
mitre_attack_technique_name = "Disk Structure Wipe"
severity = "CRITICAL"
confidence = "HIGH"
priority = "HIGH"
version = "1.0"
events:
(
/* Vector 1: Raw PhysicalDrive handle in process command line */
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e.target.process.command_line, `(?i)physicaldrive`)
)
or
/* Vector 2: dd.exe targeting physical disk or wipe source devices */
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e.target.process.file.full_path, `(?i)\\dd\.exe$`)
and re.regex($e.target.process.command_line, `(?i)(physicaldrive|if=/dev/zero|if=/dev/urandom)`)
)
or
/* Vector 3: diskpart.exe launched outside legitimate management console */
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e.target.process.file.full_path, `(?i)\\diskpart\.exe$`)
and not re.regex($e.principal.process.file.full_path, `(?i)(mmc\.exe|diskmgmt\.msc|taskschd\.msc)`)
)
or
/* Vector 4: Known wiper driver file created in user-writable directory */
(
$e.metadata.event_type = "FILE_CREATION"
and re.regex($e.target.file.full_path, `(?i)\.sys$`)
and (
re.regex($e.target.file.full_path, `(?i)(elrawdsk|elrawdisk|epmntdrv|hermeticwiper|killdisk|caddywiper)`)
or re.regex($e.target.file.full_path, `(?i)\\(temp|appdata|programdata|users\\[^\\]+\\downloads)\\`)
)
)
or
/* Vector 5: Known wiper kernel driver load */
(
$e.metadata.event_type = "DRIVER_UNCATEGORIZED"
and re.regex($e.target.file.full_path, `(?i)(elrawdsk|elrawdisk|epmntdrv|hermeticwiper|killdisk)`)
)
or
/* Vector 6: Kernel mode driver service installed from non-system path (Event 7045) */
(
$e.metadata.event_type = "SERVICE_UNSPECIFIED"
and re.regex($e.target.resource.name, `(?i)kernel mode driver`)
and re.regex($e.target.file.full_path, `(?i)\\(temp|appdata|programdata|users|downloads)\\`)
)
)
outcome:
$hostname = $e.principal.hostname
$username = $e.principal.user.userid
$process_path = $e.target.process.file.full_path
$command_line = $e.target.process.command_line
$file_path = $e.target.file.full_path
$event_type = $e.metadata.event_type
$risk_score = max(
if(re.regex($e.target.process.command_line, `(?i)physicaldrive`), 75, 0),
if(re.regex($e.target.file.full_path, `(?i)(elrawdsk|epmntdrv|hermeticwiper)`), 95, 0),
if($e.metadata.event_type = "SERVICE_UNSPECIFIED", 80, 0),
if($e.metadata.event_type = "DRIVER_UNCATEGORIZED", 90, 0),
60
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1561.002 Disk Structure Wipe across six UDM detection vectors: PROCESS_LAUNCH for raw PhysicalDrive command-line access and wiper tool commands (dd.exe, diskpart.exe), FILE_CREATION for known wiper driver drops to user-writable paths, DRIVER_UNCATEGORIZED for wiper kernel driver loads, and SERVICE_UNSPECIFIED for kernel mode driver service installations from non-system directories. The outcome block computes a risk score reflecting severity of each match and extracts forensic fields for triage.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise storage array management software and HBA drivers (LSI MegaRAID, Broadcom Emulex, Marvell RAID) that stage kernel drivers to non-system directories during firmware update or driver installation procedures
- Legitimate forensic imaging operations by incident response or IT asset management teams using dd.exe with PhysicalDrive targets during evidence collection, disk duplication, or secure decommissioning workflows
- Full-disk encryption deployment pipelines using VeraCrypt, McAfee Drive Encryption, or Sophos SafeGuard that create and install kernel drivers from %ProgramData% staging paths during initial volume encryption setup before copying to System32\drivers
Other platforms for T1561.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1MBR Overwrite Simulation on VHD (Windows, Safe)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'PhysicalDrive'. Sysmon Event ID 11: File Creation for mbr-test.vhd in %TEMP%. DeviceProcessEvents will show the PowerShell process with the raw disk handle pattern. Windows Event ID 4688 (if command-line auditing enabled) captures the full PowerShell command. DeviceFileEvents captures the VHD file creation.
- Test 2Kernel Driver Drop to Temp Directory (Windows)
Expected signal: Sysmon Event ID 11: File Created — TargetFilename matches '*\Temp\elrawdsk.sys'. Sysmon Event ID 1: Process Create for powershell.exe invoking New-Service. Windows System Event ID 7045: New Service Installed with ServiceName=RawDiskDrv, ServiceFileName pointing to %TEMP%\elrawdsk.sys, ServiceType=kernel mode driver. Security Event ID 4697: A service was installed in the system.
- Test 3Linux MBR Overwrite on Loop Device (Linux, Safe)
Expected signal: Sysmon for Linux (if deployed): ProcessCreate event showing dd with arguments 'if=/dev/zero of=/dev/loop* bs=512 count=1'. auditd (if configured with execve rules): EXECVE record capturing the full dd command with the loop device path. /var/log/auth.log or journald: sudo/su records if the test required privilege elevation. bash_history: dd command with /dev/zero source.
- Test 4WhisperGate-Style Malicious Bootloader Drop Pattern (Windows)
Expected signal: Sysmon Event ID 11: File Created — TargetFilename '$env:TEMP\stage1.bin'. Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing '[Convert]::FromBase64String' and 'WriteAllBytes'. PowerShell ScriptBlock Log Event ID 4104: full script with staging path and base64 operations. DeviceFileEvents: file creation event for stage1.bin in TEMP.
References (10)
- https://attack.mitre.org/techniques/T1561/002/
- https://www.symantec.com/connect/blogs/shamoon-attacks
- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
- https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
- https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf
- https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1561.002/T1561.002.md
- https://docs.microsoft.com/sysinternals/downloads/sysmon
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
Unlock Pro Content
Get the full detection package for T1561.002 including response playbook, investigation guide, and atomic red team tests.