Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have been observed leveraging third-party drivers like RawDisk to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.(Citation: Novetta Blockbuster Destructive Malware)
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
AC-3 | Access Enforcement | Protects | T1561.001 | Disk Content Wipe | |
AC-6 | Least Privilege | Protects | T1561.001 | Disk Content Wipe | |
CM-2 | Baseline Configuration | Protects | T1561.001 | Disk Content Wipe | |
CP-10 | System Recovery and Reconstitution | Protects | T1561.001 | Disk Content Wipe | |
CP-2 | Contingency Plan | Protects | T1561.001 | Disk Content Wipe | |
CP-7 | Alternate Processing Site | Protects | T1561.001 | Disk Content Wipe | |
CP-9 | System Backup | Protects | T1561.001 | Disk Content Wipe | |
SI-3 | Malicious Code Protection | Protects | T1561.001 | Disk Content Wipe | |
SI-4 | System Monitoring | Protects | T1561.001 | Disk Content Wipe | |
SI-7 | Software, Firmware, and Information Integrity | Protects | T1561.001 | Disk Content Wipe |
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
action.malware.variety.Destroy data | Destroy or corrupt stored data | related-to | T1561.001 | Disk Wipe: Disk Content Wipe |
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
aws_rds | AWS RDS | technique_scores | T1561.001 | Disk Content Wipe |
Comments
AWS RDS supports the replication and recovery of database instances. In the event that a database instance is deleted during a disk wipe, AWS RDS can be used to restore the database instance to a previous point in time. However, this mapping is only given a score of Partial because AWS RDS only provides a backup of the database instance and not the underlying system that it is hosted on.
References
|
aws_cloudendure_disaster_recovery | AWS CloudEndure Disaster Recovery | technique_scores | T1561.001 | Disk Content Wipe |
Comments
AWS CloudEndure Disaster Recovery enables the replication and recovery of servers into AWS Cloud. In the event that server disks are wiped, AWS CloudEndure can be used to provision an instance of the server from a previous point in time within minutes. As a result, this mapping is given a score of Significant.
References
|