Diskpart Executed via Script File to Remove Recovery Partition
Detects the execution of the Windows Diskpart utility using a script file, as indicated by the /s command-line argument. This behavior is often associated with malicious actors attempting to perform destructive operations such as removing recovery partitions to inhibit system recovery during ransomware attacks.
Sigma
