MITRE ATT&CKsoftware (tool)

S0364 RawDisk

Published 2019-03-25 Modified 2024-11-17 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2019-03-25

Description

RawDisk is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.

Related

Uses · MITRE ATT&CK (3)

  • T1561.001 Disk Content Wipe sub-technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1485 Data Destruction technique

Referenced by MITRE ATT&CK · uses (2)

  • C0038 HomeLand Justice campaign
  • G0032 Lazarus Group group

References