Settra Ransomware: diskpart /s Recovery Partition Removal
Detects the execution of diskpart.exe with command-line arguments using the /s flag, triggered by processes originating from unconventional locations such as Perflogs or Documents, or by executables ending with _win64.exe. Diskpart is a command-line disk partitioning utility that can be abused for credential dumping, data staging, or destructive activities.
Microsoft Sentinel (KQL)
