Disk Wiping via diskpart, format.com, sdelete, eraser, or cipher /w

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the execution of common Windows utilities (diskpart, format, cipher, sdelete, eraser) when used with flags indicative of data destruction or disk wiping behavior. This rule monitors for process creations involving commands designed to irrecoverably erase data or wipe drive contents.