mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
brightmt
084ba830d3
* Update self-deletion.md Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml) * Update obfuscated-files-or-information.md added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml * Update disk-wipe.md Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml * Update dns-communication.md Removed duplication in APIs in "Resolve DNS" CAPA rule * Update socket-communication.md Updated APIs for "create raw socket" CAPA rule * Update socket-communication.md Updated APIs on CAPA rule "get socket status" * Update socket-communication.md Updated CAPA rule "initialize Winsock library" * Update socket-communication.md Updated API listing on CAPA rule "receive data on socket" * Update socket-communication.md Updated API listing for "send data on socket" CAPA rule * Update socket-communication.md Update APIs for CAPA rule "set socket configuration" * Update socket-communication.md Updated CAPA rule "connect tcp socket" to add APIs * Update socket-communication.md Added APIs to CAPA rule "create tcp socket" * Update socket-communication.md Added APIs to "create UDP socket" CAPA rule * Update encrypt-data.md Added new APIs to "encrypt data using DPAPI" CAPA rule * Update install-driver.md Added APIs to CAPA rule "install driver" * Update set-file-attributes.md Added APIs to CAPA rule "change file permissions on Linux" * Update writes-file.md Updated APIs for CAPA rule "write file on linux" * Update system-information-discovery.md Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1 * Update create-process.md Added API to "create process on linux" CAPA rule * Update hijack-execution-flow.md Added API calls to CAPA rule "execute shellcode via Windows callback function" * Update self-deletion.md Changed link to master * Update obfuscated-files-or-information.md Changed rule link to release to point to master * Update system-information-discovery.md Removed nursery rules * Update disk-wipe.md Updated link to master branch * Update socket-communication.md Checked for correct socket listings under the APIs
2.4 KiB
2.4 KiB
| ID | F0014 |
| Objective(s) | Impact |
| Related ATT&CK Techniques | Disk Wipe (T1561.001) |
| Impact Type | Availability |
| Version | 3.2 |
| Created | 15 April 2021 |
| Last Modified | 30 April 2024 |
Disk Wipe
Malware may erase the content of storage devices. This behavior is different than Data Destruction (E1485) because sections of the disk are erased rather than individual files.
This description refines the ATT&CK Disk Wipe: Disk Content Wipe (T1561.001) sub-technique.
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Shamoon | 2012 | -- | An overwrite component will overwrite the MBR so that the compromised computer can no longer start. [1] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| overwrite Master Boot Record (MBR) | Disk Wipe (F0014) | kernel32.WriteFile |
| delete drive layout via IOCTL | Disk Wipe (F0014) | -- |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| deletes_shadow_copies | Disk Wipe (F0014) | ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW |
| deletes_system_state_backup | Disk Wipe (F0014) | ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW |
| wiper_zeroedbytes | Disk Wipe (F0014) | NtWriteFile |
References
[1] https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments