Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
2
2
1
Platforms
2
Products / Services
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects the execution of the Windows Diskpart utility using a script file, as indicated by the /s command-line argument. This behavior is often associated with malicious actors attempting to perform destructive operations such as removing recovery partitions to inhibit system recovery during ransomware attacks.
Detects the use of the Windows 'diskpart' utility combined with a script or command execution containing 'clean all', which performs a destructive multi-pass overwrite of disk data structures to render it irrecoverable. This behavior is typically associated with malicious data destruction or wiping activities.
