Diskpart Script Execution as Child of Settra Ransomware Binary

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•4

Detects execution of the Windows diskpart utility using a script file, initiated by a process with a name ending in _win64.exe. This pattern is commonly used in malicious scripts for disk manipulation or inhibiting system recovery.