Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1561.001_disk-content-wipe
Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Passed 17 of 22 test cases with the skill, and 10 of 22 without it.
and 6 more in the full report
7 fixed10 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
In the MITRE ATT&CK framework hierarchy, what is the exact numerical sub-technique ID for Disk Content Wipe, and what parent technique ID does it fall under?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies sub-technique ID T1561.001. | Missed | Passed |
| Identifies parent technique ID T1561. | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1561
Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface. Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data. Adversaries have also been observed leveraging third-party drivers like RawDisk to directly access disk content. This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.
Platforms: Linux, Network Devices, Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Disk Content Wipe by examining the target platforms (Linux, Network Devices, Windows).
Assess Existing Defenses: Review whether mitigations for T1561.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 10 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.