Diskpart — Malware Profile
Diskpart is a Windows command-line utility that is used to manage the computer’s drives, which includes disks, partitions, volumes and virtual hard disks. Adversaries may abuse Diskpart to perform discovery and destructive actions on a system’s storage. For example, adversaries have been observed using Diskpart to conduct Discovery techniques to enumerate disks and volumes to gather information about the host environment, and to execute commands such as `clean all` to remove partition information and overwrite data across disks, resulting in data destruction.
MITRE ATT&CK techniques (5)
- T1059.003 Windows Command Shell
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1222.001 Windows Permissions
- T1561.002 Disk Structure Wipe