Settra Ransomware Diskpart Recovery Partition Deletion via Script

Ankit Mehta@Secvyn

•updated Sep 18, 2026•0•0•1

Detects the execution of diskpart.exe using a script file (via the /s parameter) where the parent process is not a standard system utility. This behavior is often indicative of attackers using diskpart to automate disk operations, such as clearing volume shadowing or modifying disk configurations, during post-exploitation activities.