Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-DiskWipeUtilityExecution.
Upgrade to ProDetect Disk Wipe — Destructive Disk-Clearing Utility Execution in IBM QRadar
Wiper attacks and the destructive final stage of some ransomware/extortion intrusions rely on a small, well-known set of disk-clearing tools and commands rather than custom code, because overwriting or reformatting a disk does not require sophistication — it requires only that the operator have sufficient privilege and be willing to accept the outcome. Common patterns: Sysinternals sdelete/sdelete64 invoked with the -p (passes), -z (zero free space), or -c (clean free space) flags to securely overwrite file or free-space content; cipher.exe /w: to wipe deallocated disk space (a native Windows binary requiring no download, favored specifically because it evades application-allowlisting that would block sdelete); diskpart.exe run non-interactively via a script file containing "clean" or "clean all" against a selected disk/volume; format.com or PowerShell's Clear-Disk/Remove-Partition/Initialize-Disk cmdlets invoked with -Confirm:$false against a data or boot volume; and on Linux, dd with if=/dev/zero or if=/dev/urandom targeting a block device, shred -vfz, or wipefs -a. WhisperGate and Shamoon-family wipers used variations of these same primitives (WhisperGate additionally corrupted the MBR directly). None of these tools/commands has a legitimate high-volume production use case against a system or data volume — they appear almost exclusively during authorized secure-decommissioning workflows or a destructive attack, making this a high-fidelity, low-noise detection surface when properly scoped away from asset-disposal processes.
MITRE ATT&CK
- Tactic
- Impact
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
devicename AS ComputerName,
username AS Username,
UTF8(payload) AS RawEvent,
CASE
WHEN UTF8(payload) ILIKE '%diskpart%' AND UTF8(payload) ILIKE '%clean%' THEN 'DiskpartScriptedClean'
WHEN UTF8(payload) ILIKE '%format%' AND (UTF8(payload) ILIKE '%/y%' OR UTF8(payload) ILIKE '%/fs%') THEN 'NonInteractiveFormat'
WHEN UTF8(payload) ILIKE '%dd %' AND UTF8(payload) ILIKE '%of=/dev/%' THEN 'DdBlockDeviceOverwrite'
WHEN UTF8(payload) ILIKE '%sdelete%' THEN 'SdeleteSecureOverwrite'
WHEN UTF8(payload) ILIKE '%cipher%' AND UTF8(payload) ILIKE '%/w:%' THEN 'CipherFreeSpaceWipe_NativeBinary'
WHEN UTF8(payload) ILIKE '%shred%' THEN 'ShredSecureDelete'
WHEN UTF8(payload) ILIKE '%wipefs%' THEN 'WipefsSignatureWipe'
ELSE 'Unknown'
END AS WipeIndicator
FROM events
WHERE
LOGSOURCETYPEID IN (12, 232)
AND (
UTF8(payload) ILIKE '%sdelete%' OR UTF8(payload) ILIKE '%cipher%/w:%'
OR UTF8(payload) ILIKE '%diskpart%' OR UTF8(payload) ILIKE '%format%/fs%'
OR UTF8(payload) ILIKE '%dd %of=/dev/%' OR UTF8(payload) ILIKE '%shred%'
OR UTF8(payload) ILIKE '%wipefs%'
)
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500QRadar AQL detection over Windows Security/Sysmon and Linux audit sources matching the full disk-wipe primitive set via payload string matching, with a CASE-based indicator classification for SOC triage.
Data Sources
Required Tables
False Positives & Tuning
- Documented decommissioning or sanitization workflows
- Forensic imaging processes
Other platforms for THREAT-Impact-DiskWipeUtilityExecution
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate sdelete Secure Overwrite
Expected signal: Sysmon Event ID 1: sdelete64.exe process creation with '-p' flag in command line.
- Test 2Simulate Diskpart Scripted Clean
Expected signal: Sysmon Event ID 1: diskpart.exe process creation with '/s' flag referencing the script file.
- Test 3Simulate dd Block Device Overwrite (Linux)
Expected signal: auditd EXECVE record for dd with of=/dev/loop9 and if=/dev/zero in the argument list.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-DiskWipeUtilityExecution — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month