AN0827
Analytic 0827
Windows
Processes attempting raw disk access to overwrite sensitive structures such as the MBR or partition table using \\.\PhysicalDrive notation. Detection relies on correlating process creation, privilege escalation, and raw sector writes in Sysmon and Security logs.
WinEventLog:Security
EventCode=4673
WinEventLog:Sysmon
Raw write attempts targeting \\.\PhysicalDrive0 or sector 0 (MBR/partition table)
WinEventLog:Sysmon
EventCode=6
[SectorRange]
Specify which sectors are considered critical (MBR, partition table) to reduce noise.
[ProcessWhitelist]
Exclude legitimate low-level disk management or imaging tools used by administrators.
AN0828
Analytic 0828
Linux
Execution of utilities (dd, hdparm, sgdisk) or custom binaries attempting to overwrite disk boot structures (/dev/sda MBR sector or partition tables). Detection correlates shell execution with syscalls writing to sector 0 or disk metadata blocks.
auditd:SYSCALL
write syscalls to /dev/sd* targeting offset 0
auditd:EXECVE
Execution of dd/sgdisk with arguments writing to sector 0 or partition table
[TargetDevices]
Define specific device paths to monitor (e.g., /dev/sda, /dev/nvme0n1).
[OffsetThreshold]
Focus on suspicious writes at disk offsets corresponding to MBR/partition structures.
AN0829
Analytic 0829
macOS
Abnormal invocation of diskutil or asr that modifies partition tables or initializes raw devices. Monitor for IOKit system calls targeting disk headers or EFI boot sectors, correlated with elevated privileges.
macos:unifiedlog
diskutil partitionDisk or eraseVolume with partition scheme modifications
macos:unifiedlog
IOKit raw disk write to EFI/boot partition sectors
[AdminToolWhitelist]
System provisioning workflows may legitimately re-partition disks; whitelist by context.
AN0830
Analytic 0830
Network Devices
Execution of destructive CLI commands such as format flash:, format disk, or equivalent vendor-specific commands that erase filesystem structures. Detection correlates AAA logs showing privileged access with immediate format/erase commands.
networkdevice:cli
format flash:, format disk, reformat commands
networkdevice:syslog
Privileged login followed by destructive format command
[CommandPatterns]
Expand detection to cover vendor-specific destructive commands.
[PrivilegedUsers]
Whitelist authorized maintenance sessions to reduce false positives.