Branch was auto-updated.

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -33,6 +33,7 @@ tags:
   - IcedID
   - Log4Shell CVE-2021-44228
   - WhisperGate
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - Trickbot
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -38,6 +38,7 @@ tags:
   - XMRig
   - Remcos
   - WhisperGate
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
   - Remcos
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/suspicious_process_file_path.yml

@@ -35,6 +35,7 @@ tags:
   - XMRig
   - Remcos
   - WhisperGate
+  - Hermetic Wiper
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/windows_disable_memory_crash_dump.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Data Destruction
   - Ransomware
+  - Hermetic Wiper
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_file_without_extension_in_critical_folder.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Data Destruction
+  - Hermetic Wiper
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Hermetic Wiper
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_raw_access_to_disk_volume_partition.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Data Destruction
+  - Hermetic Wiper
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - WhisperGate
+  - Hermetic Wiper
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
   kill_chain_phases:

stories/hermeticwiper.yml

@@ -0,0 +1,22 @@
+name: Hermetic Wiper
+id: b7511c2e-9a10-11ec-99e3-acde48001122
+version: 1
+date: '2022-03-02'
+author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk
+description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities
+  that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.
+narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting
+  multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. 
+references:
+- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
+- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
+tags:
+  analytic_story: Hermetic Wiper
+  category:
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection