TOKYOCORE MBR Overwrite via Raw PhysicalDrive0 Access

Detects direct raw disk access to \\.\PhysicalDrive0 consistent with TOKYOCORE's wiper mode overwriting the Master Boot Record (sector 0) to render the system unbootable.

Sigma