ATT&CK T1561 - Possible Disk Wipe C2 Command

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects potential command and control (C2) communication related to disk wiping activities. It specifically looks for the keywords "wipe" and "disk" (case-insensitive) within 50 bytes of each other in TCP traffic flowing from the server to the client. This pattern suggests a C2 server instructing a compromised client to perform disk wiping, which aligns with the MITRE ATT&CK technique T1561 (Disk Wipe) under the Impact tactic.