Techniques › T1561.001 › AN0882
AN0882 Analytic 0882
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Processes attempting raw disk access via \\.\PhysicalDrive paths, abnormal file I/O to MBR/boot sectors, or loading of third-party drivers (e.g., RawDisk) that enable disk overwrite. Correlate process creation, privilege usage, and disk modification events within a short time window.</p>
- Detects
- T1561.001 Disk Content Wipe
- Part of
- DET0316 Detection Strategy for Disk Content Wipe via Direct Access and Overwrite
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4673 | DC0013 User Account Metadata |
| WinEventLog:Sysmon | Raw disk writes targeting \\.\PhysicalDrive* or MBR locations | DC0046 Drive Modification |
| WinEventLog:Sysmon | EventCode=6 | DC0079 Driver Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ProcessWhitelist | Backup, forensics, or imaging tools may perform legitimate raw disk access — requires tuning per environment. |
TimeWindow | Correlation threshold for process execution, driver load, and raw disk writes. |