Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-DiskWipeUtilityExecution.
Upgrade to ProDetect Disk Wipe — Destructive Disk-Clearing Utility Execution in Splunk
Wiper attacks and the destructive final stage of some ransomware/extortion intrusions rely on a small, well-known set of disk-clearing tools and commands rather than custom code, because overwriting or reformatting a disk does not require sophistication — it requires only that the operator have sufficient privilege and be willing to accept the outcome. Common patterns: Sysinternals sdelete/sdelete64 invoked with the -p (passes), -z (zero free space), or -c (clean free space) flags to securely overwrite file or free-space content; cipher.exe /w: to wipe deallocated disk space (a native Windows binary requiring no download, favored specifically because it evades application-allowlisting that would block sdelete); diskpart.exe run non-interactively via a script file containing "clean" or "clean all" against a selected disk/volume; format.com or PowerShell's Clear-Disk/Remove-Partition/Initialize-Disk cmdlets invoked with -Confirm:$false against a data or boot volume; and on Linux, dd with if=/dev/zero or if=/dev/urandom targeting a block device, shred -vfz, or wipefs -a. WhisperGate and Shamoon-family wipers used variations of these same primitives (WhisperGate additionally corrupted the MBR directly). None of these tools/commands has a legitimate high-volume production use case against a system or data volume — they appear almost exclusively during authorized secure-decommissioning workflows or a destructive attack, making this a high-fidelity, low-noise detection surface when properly scoped away from asset-disposal processes.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
((Image="*\\sdelete.exe" OR Image="*\\sdelete64.exe") AND (CommandLine="*-p*" OR CommandLine="*-z*" OR CommandLine="*-c*"))
OR (Image="*\\cipher.exe" AND CommandLine="*/w:*")
OR (Image="*\\diskpart.exe" AND CommandLine="*/s*")
OR (Image="*\\format.com" AND (CommandLine="*/y*" OR CommandLine="*/fs*"))
OR (Image="*\\powershell.exe" AND (CommandLine="*Clear-Disk*" OR CommandLine="*Remove-Partition*" OR CommandLine="*Initialize-Disk*") AND CommandLine="*-Confirm:\$false*")
)
| eval WipeIndicator=case(
match(Image, "(?i)sdelete"), "SdeleteSecureOverwrite",
match(Image, "(?i)cipher"), "CipherFreeSpaceWipe_NativeBinary",
match(Image, "(?i)diskpart"), "DiskpartScriptedClean",
match(Image, "(?i)format"), "NonInteractiveFormat",
match(Image, "(?i)powershell"), "PowerShellDiskClearCmdlet",
true(), "Unknown"
)
| eval RiskScore=case(
WipeIndicator IN ("DiskpartScriptedClean","NonInteractiveFormat","PowerShellDiskClearCmdlet"), 100,
WipeIndicator IN ("SdeleteSecureOverwrite","CipherFreeSpaceWipe_NativeBinary"), 85,
true(), 60
)
| append [
search index=linux sourcetype="linux:audit" (type=EXECVE)
(exe="*/dd" AND (CommandLine="*of=/dev/sd*" OR CommandLine="*of=/dev/nvme*" OR CommandLine="*if=/dev/zero*" OR CommandLine="*if=/dev/urandom*"))
OR (exe="*/shred" AND (CommandLine="*-vfz*" OR CommandLine="*-fz*"))
OR (exe="*/wipefs" AND CommandLine="*-a*")
| eval WipeIndicator=case(
match(exe, "dd$"), "DdBlockDeviceOverwrite",
match(exe, "shred$"), "ShredSecureDelete",
match(exe, "wipefs$"), "WipefsSignatureWipe",
true(), "Unknown")
| eval RiskScore=if(WipeIndicator="DdBlockDeviceOverwrite", 100, 85)
]
| table _time, host, user, Image, exe, CommandLine, WipeIndicator, RiskScore
| sort - RiskScoreSPL detection over Sysmon (Windows) and Linux auditd EXECVE records covering the same disk-wipe primitive set: sdelete, cipher /w:, diskpart scripted clean, format.com, PowerShell disk-clearing cmdlets, and Linux dd/shred/wipefs against block devices.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Documented asset-decommissioning or disk-sanitization workflows
- Forensic imaging or evidence-handling processes using dd
- Intentional OS reimaging processes on designated staging hosts
Other platforms for THREAT-Impact-DiskWipeUtilityExecution
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate sdelete Secure Overwrite
Expected signal: Sysmon Event ID 1: sdelete64.exe process creation with '-p' flag in command line.
- Test 2Simulate Diskpart Scripted Clean
Expected signal: Sysmon Event ID 1: diskpart.exe process creation with '/s' flag referencing the script file.
- Test 3Simulate dd Block Device Overwrite (Linux)
Expected signal: auditd EXECVE record for dd with of=/dev/loop9 and if=/dev/zero in the argument list.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-DiskWipeUtilityExecution — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month