WMI Physical Disk Enumeration and Raw Wipe Utility Indicators
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Cortex XDR
