Disk Wipe: Disk Content Wipe T1561.001

Tactic: Impact

Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
count1ge 15
operationName1eq 1wipe manageddevice
sourcetype1eq 1azure:monitor:activity

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
countge
5
13
operationNameeq
wipe manageddevice
1
sourcetypeeq
azure:monitor:activity
15

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 1 rule

Splunk 1 rule