Disk wipe / firmware corruption
Raw disk or firmware destroyed to brick devices
categoryPhysical, insider and cross-cutting attacksseverityHighdetectabilityLowlabnot yet measured
Classification
32 values: 12 reviewed, 16 imported, 4 derived. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Attacker skill required | High |
| Resources required | Medium |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | Availability |
| Platform | LinuxmacOSNetwork DevicesWindows |
| Environment | Edge / IoTOn-premisesOT / ICS |
| Target asset class | EndpointPhysicalServer |
| Kill-chain phase (tactic) | Impact |
Detection & telemetry
| Detectability | Low |
|---|---|
| Data sources (ATT&CK data components) | Command ExecutionDrive AccessDrive ModificationDriver LoadFirmware ModificationNetwork Traffic ContentProcess CreationUser Account Authentication |
Detection & response
Mitigated by 5
- M1026 attack-mitigation
- M1046 attack-mitigation
- M1051 attack-mitigation
- M1053 attack-mitigation
D3-DKPd3fend
Detected by 4
- DET0137 attack-detection-strategy
- DET0167 attack-detection-strategy
71d65515-c436-43c0-841b-236b1f32c21esigmad94a35f0-7a29-45f6-90a0-80df6159967csigma
Framework references
- Primary source: https://attack.mitre.org/tactics/TA0040/
- attack: T1561 (primary)
- attack: T1495
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 697 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)