Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-DiskWipeUtilityExecution.
Upgrade to ProDetect Disk Wipe — Destructive Disk-Clearing Utility Execution in Elastic Security
Wiper attacks and the destructive final stage of some ransomware/extortion intrusions rely on a small, well-known set of disk-clearing tools and commands rather than custom code, because overwriting or reformatting a disk does not require sophistication — it requires only that the operator have sufficient privilege and be willing to accept the outcome. Common patterns: Sysinternals sdelete/sdelete64 invoked with the -p (passes), -z (zero free space), or -c (clean free space) flags to securely overwrite file or free-space content; cipher.exe /w: to wipe deallocated disk space (a native Windows binary requiring no download, favored specifically because it evades application-allowlisting that would block sdelete); diskpart.exe run non-interactively via a script file containing "clean" or "clean all" against a selected disk/volume; format.com or PowerShell's Clear-Disk/Remove-Partition/Initialize-Disk cmdlets invoked with -Confirm:$false against a data or boot volume; and on Linux, dd with if=/dev/zero or if=/dev/urandom targeting a block device, shred -vfz, or wipefs -a. WhisperGate and Shamoon-family wipers used variations of these same primitives (WhisperGate additionally corrupted the MBR directly). None of these tools/commands has a legitimate high-volume production use case against a system or data volume — they appear almost exclusively during authorized secure-decommissioning workflows or a destructive attack, making this a high-fidelity, low-noise detection surface when properly scoped away from asset-disposal processes.
MITRE ATT&CK
- Tactic
- Impact
Elastic Detection Query
any where event.category == "process" and event.type == "start" and (
(process.name : ("sdelete.exe", "sdelete64.exe") and process.command_line : ("*-p*", "*-z*", "*-c*")) or
(process.name : "cipher.exe" and process.command_line : "*/w:*") or
(process.name : "diskpart.exe" and process.command_line : "*/s*") or
(process.name : "format.com" and process.command_line : ("*/y*", "*/fs*")) or
(process.name : "powershell.exe" and process.command_line : ("*Clear-Disk*", "*Remove-Partition*", "*Initialize-Disk*") and process.command_line : "*-Confirm:$false*") or
(process.name : ("dd", "dd.exe") and process.command_line : ("*of=/dev/sd*", "*of=/dev/nvme*", "*if=/dev/zero*", "*if=/dev/urandom*")) or
(process.name : "shred" and process.command_line : ("*-vfz*", "*-fz*")) or
(process.name : "wipefs" and process.command_line : "*-a*")
)Detects execution of the common disk/data-wipe primitive set (sdelete, cipher /w:, diskpart clean, format, PowerShell disk-clearing cmdlets, dd/shred/wipefs against block devices) using Elastic ECS process events.
Data Sources
Required Tables
False Positives & Tuning
- Documented asset-decommissioning or disk-sanitization workflows
- Forensic imaging processes using dd for evidence handling
- Intentional OS reimaging on designated staging hosts
Other platforms for THREAT-Impact-DiskWipeUtilityExecution
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate sdelete Secure Overwrite
Expected signal: Sysmon Event ID 1: sdelete64.exe process creation with '-p' flag in command line.
- Test 2Simulate Diskpart Scripted Clean
Expected signal: Sysmon Event ID 1: diskpart.exe process creation with '/s' flag referencing the script file.
- Test 3Simulate dd Block Device Overwrite (Linux)
Expected signal: auditd EXECVE record for dd with of=/dev/loop9 and if=/dev/zero in the argument list.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-DiskWipeUtilityExecution — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month