From d41712757c765346baa4eaf56fac18408313cd96 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 2 Mar 2022 12:13:37 -0800 Subject: [PATCH 1/3] analyticstory --- stories/hermeticwiper.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 stories/hermeticwiper.yml diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml new file mode 100644 index 0000000000..885a354c60 --- /dev/null +++ b/stories/hermeticwiper.yml @@ -0,0 +1,23 @@ +name: Hermetic Wiper +id: +version: 1 +date: '2022-03-02' +author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk +description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities + that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic + story looks for abuse of Regsvr32, Executables written in administrative SMB Share, Suspcious processes, Disabling of Memory Crash DUmp and more. +narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting + multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. +references: +- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ +- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a +tags: + analytic_story: Hermetic Wiper + category: + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From b8cc27d347910747e0933c99925d18c47b04a3ca Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 12:35:56 -0800 Subject: [PATCH 2/3] tag with hermetic --- detections/endpoint/cmd_carry_out_string_command_parameter.yml | 1 + .../executable_file_written_in_administrative_smb_share.yml | 1 + .../executables_or_script_creation_in_suspicious_path.yml | 1 + .../endpoint/regsvr32_silent_and_install_param_dll_loading.yml | 1 + detections/endpoint/suspicious_process_file_path.yml | 1 + detections/endpoint/windows_disable_memory_crash_dump.yml | 1 + .../windows_file_without_extension_in_critical_folder.yml | 1 + ...windows_modify_show_compress_color_and_info_tip_registry.yml | 1 + .../endpoint/windows_raw_access_to_disk_volume_partition.yml | 1 + .../endpoint/windows_raw_access_to_master_boot_record_drive.yml | 1 + stories/hermeticwiper.yml | 2 +- 11 files changed, 11 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index d58d8970f2..da15eb4ccf 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -33,6 +33,7 @@ tags: - IcedID - Log4Shell CVE-2021-44228 - WhisperGate + - Hermetic Wiper automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 223f9a1c16..9cbc6bb8d5 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Active Directory Lateral Movement - Trickbot + - Hermetic Wiper automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index ee081a33d7..f3b5cf9ca5 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -38,6 +38,7 @@ tags: - XMRig - Remcos - WhisperGate + - Hermetic Wiper automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 8535dac57e..013a7e4816 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Suspicious Regsvr32 Activity - Remcos + - Hermetic Wiper automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 17c24c545f..ce259ece01 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -35,6 +35,7 @@ tags: - XMRig - Remcos - WhisperGate + - Hermetic Wiper automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 5216175c4c..9701eaf13d 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Data Destruction - Ransomware + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index aa1a544d87..43ea51dc14 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Data Destruction + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index ff86c50101..3bd4c393a3 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 5473f738bd..26626f743c 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Data Destruction + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 30f88fdb60..59781686b4 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - WhisperGate + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log kill_chain_phases: diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml index 885a354c60..4f7c832a2e 100644 --- a/stories/hermeticwiper.yml +++ b/stories/hermeticwiper.yml @@ -1,5 +1,5 @@ name: Hermetic Wiper -id: +id: b7511c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk From 39fca1d7ac84ba46cbc15e130c7605764b25b6b8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 12:48:39 -0800 Subject: [PATCH 3/3] update desc --- stories/hermeticwiper.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml index 4f7c832a2e..6e026c761b 100644 --- a/stories/hermeticwiper.yml +++ b/stories/hermeticwiper.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-03-02' author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities - that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic - story looks for abuse of Regsvr32, Executables written in administrative SMB Share, Suspcious processes, Disabling of Memory Crash DUmp and more. + that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more. narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. references: