Diskpart is a Windows command-line utility that is used to manage the computer’s drives, which includes disks, partitions, volumes and virtual hard disks.
Adversaries may abuse Diskpart to perform discovery and destructive actions on a system’s storage. For example, adversaries have been observed using Diskpart to conduct Discovery techniques to enumerate disks and volumes to gather information about the host environment, and to execute commands such as `clean all` to remove partition information and overwrite data across disks, resulting in data destruction.
| Technique | Procedure example |
|---|---|
| T1059.003 Windows Command Shell |
Diskpart can execute a disk partition script file, which attempts to mount a virtual hard disk. Diskpart can also assign and mount virtual disks. |
| T1082 System Information Discovery |
Diskpart can show information about the selected disk, partition, volume, or virtual hard disk (VHD). |
| T1083 File and Directory Discovery |
If executed with elevated privileges, Diskpart can list all volumes, including virtual disks. |
| T1222.001 Windows Permissions |
Diskpart can be used to display, set, or clear attributes of a disk or volume. |
| T1561.002 Disk Structure Wipe |
Diskpart can be used to delete a partition or a volume. Diskpart can also be used to remove all partitions or volume formatting from the selected disk. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
