Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-DiskWipeUtilityExecution.
Upgrade to ProDetect Disk Wipe — Destructive Disk-Clearing Utility Execution in Microsoft Sentinel
Wiper attacks and the destructive final stage of some ransomware/extortion intrusions rely on a small, well-known set of disk-clearing tools and commands rather than custom code, because overwriting or reformatting a disk does not require sophistication — it requires only that the operator have sufficient privilege and be willing to accept the outcome. Common patterns: Sysinternals sdelete/sdelete64 invoked with the -p (passes), -z (zero free space), or -c (clean free space) flags to securely overwrite file or free-space content; cipher.exe /w: to wipe deallocated disk space (a native Windows binary requiring no download, favored specifically because it evades application-allowlisting that would block sdelete); diskpart.exe run non-interactively via a script file containing "clean" or "clean all" against a selected disk/volume; format.com or PowerShell's Clear-Disk/Remove-Partition/Initialize-Disk cmdlets invoked with -Confirm:$false against a data or boot volume; and on Linux, dd with if=/dev/zero or if=/dev/urandom targeting a block device, shred -vfz, or wipefs -a. WhisperGate and Shamoon-family wipers used variations of these same primitives (WhisperGate additionally corrupted the MBR directly). None of these tools/commands has a legitimate high-volume production use case against a system or data volume — they appear almost exclusively during authorized secure-decommissioning workflows or a destructive attack, making this a high-fidelity, low-noise detection surface when properly scoped away from asset-disposal processes.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
// THREAT: Disk Wipe utility execution (T1561.001)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
(FileName in~ ("sdelete.exe", "sdelete64.exe") and ProcessCommandLine has_any ("-p", "-z", "-c"))
or (FileName =~ "cipher.exe" and ProcessCommandLine has "/w:")
or (FileName =~ "diskpart.exe" and ProcessCommandLine has "/s")
or (FileName =~ "format.com" and ProcessCommandLine has_any ("/y", "/fs"))
or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Clear-Disk", "Remove-Partition", "Initialize-Disk") and ProcessCommandLine has "-Confirm:$false")
or (FileName in~ ("dd", "dd.exe") and ProcessCommandLine has_any ("of=/dev/sd", "of=/dev/nvme", "of=/dev/vd", "if=/dev/zero", "if=/dev/urandom"))
or (FileName =~ "shred" and ProcessCommandLine has_any ("-vfz", "-fz", "-u"))
or (FileName =~ "wipefs" and ProcessCommandLine has "-a")
)
| extend WipeIndicator = case(
FileName in~ ("sdelete.exe", "sdelete64.exe"), "SdeleteSecureOverwrite",
FileName =~ "cipher.exe", "CipherFreeSpaceWipe_NativeBinary",
FileName =~ "diskpart.exe", "DiskpartScriptedClean",
FileName =~ "format.com", "NonInteractiveFormat",
FileName =~ "powershell.exe", "PowerShellDiskClearCmdlet",
FileName in~ ("dd", "dd.exe"), "DdBlockDeviceOverwrite",
FileName =~ "shred", "ShredSecureDelete",
FileName =~ "wipefs", "WipefsSignatureWipe",
"Unknown"
)
| extend RiskScore = case(
WipeIndicator in ("DiskpartScriptedClean", "DdBlockDeviceOverwrite", "NonInteractiveFormat", "PowerShellDiskClearCmdlet"), 100,
WipeIndicator in ("SdeleteSecureOverwrite", "CipherFreeSpaceWipe_NativeBinary", "ShredSecureDelete", "WipefsSignatureWipe"), 85,
60
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, WipeIndicator, RiskScore
| sort by RiskScore desc, Timestamp descSingle-pass detection over process-creation telemetry covering the full set of common disk/data-wipe primitives on Windows and Linux: Sysinternals sdelete (secure overwrite flags), cipher.exe /w: (native-binary free-space wipe, favored to evade allowlisting), diskpart scripted clean/clean all, format.com and PowerShell Clear-Disk/Remove-Partition/Initialize-Disk against a whole disk or volume, and Linux dd/shred/wipefs against a block device. RiskScore=100 for whole-disk/volume-destructive operations (diskpart clean, dd to a raw device, format, PowerShell disk cmdlets); RiskScore=85 for file/free-space-level secure-delete tools that can still indicate anti-forensic wiping.
Data Sources
Required Tables
False Positives & Tuning
- IT asset-decommissioning workflows that legitimately use sdelete, cipher /w:, or dd to sanitize disks before disposal or redeployment — scope these to a documented decommission process/service account and time window
- Forensic imaging labs using dd to clone or zero a drive as part of evidence handling
- Endpoint refresh/reimaging processes that call diskpart clean or format as an intentional first step of an OS reinstall on a designated staging host
- Developers running Clear-Disk/Initialize-Disk in a lab environment to reset test VM storage
Other platforms for THREAT-Impact-DiskWipeUtilityExecution
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate sdelete Secure Overwrite
Expected signal: Sysmon Event ID 1: sdelete64.exe process creation with '-p' flag in command line.
- Test 2Simulate Diskpart Scripted Clean
Expected signal: Sysmon Event ID 1: diskpart.exe process creation with '/s' flag referencing the script file.
- Test 3Simulate dd Block Device Overwrite (Linux)
Expected signal: auditd EXECVE record for dd with of=/dev/loop9 and if=/dev/zero in the argument list.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-DiskWipeUtilityExecution — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month