Diskpart
MITRE ATT&CK: S9002 View on attack.mitre.org
Aliases: Diskpart
- Malware type
- wiper
- Operating systems
- windows
- Profile updated
- 2026-07-07 15:32:27
Context
Diskpart is a Windows command-line utility that is used to manage the computer’s drives, which includes disks, partitions, volumes and virtual hard disks. Adversaries may abuse Diskpart to perform discovery and destructive actions on a system’s storage. For example, adversaries have been observed using Diskpart to conduct Discovery techniques to enumerate disks and volumes to gather information about the host environment, and to execute commands such as `clean all` to remove partition information and overwrite data across disks, resulting in data destruction.
Detection coverage
- 84 Sigma rules
Malware & tools used
- Disk Structure Wipe (attack-pattern)
- Windows Permissions (attack-pattern)
- System Information Discovery (attack-pattern)
- Windows Command Shell (attack-pattern)
- File and Directory Discovery (attack-pattern)
Reports & references
- MITRE ATT&CK — S9002 (report)
- Microsoft — Diskpart (report)
- Trend Micro — Ransomware Spotlight Ransomhub (report)