Diskpart Script Execution as Child of Ransomware Binary

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects the execution of diskpart.exe using a script file (/s) launched from an atypical parent process. Diskpart is a powerful disk management utility that can be abused for staging or data destruction; invoking it via scripts from processes other than standard management shells (cmd, powershell, explorer) or services may indicate malicious activity.