Branch was auto-updated.

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -30,6 +30,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction
   - IcedID
   - Log4Shell CVE-2021-44228
   - WhisperGate

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -30,6 +30,7 @@ references:
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
+  - Data Destruction
   - Active Directory Lateral Movement
   - Trickbot
   - Hermetic Wiper

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -35,6 +35,8 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Double Zero Destructor 
+  - Data Destruction
   - XMRig
   - Remcos
   - WhisperGate

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -30,6 +30,7 @@ references:
 - https://attack.mitre.org/techniques/T1218/010/
 tags:
   analytic_story:
+  - Data Destruction
   - Suspicious Regsvr32 Activity
   - Remcos
   - Hermetic Wiper

detections/endpoint/suspicious_process_file_path.yml

@@ -32,6 +32,8 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction 
+  - Double Zero Destructor
   - XMRig
   - Remcos
   - WhisperGate

detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml

@@ -34,6 +34,7 @@ references:
 - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
   analytic_story:
+  - Data Destruction
   - Windows Defense Evasion Tactics
   - Hermetic Wiper
   - Windows Registry Abuse

detections/endpoint/windows_raw_access_to_disk_volume_partition.yml

@@ -26,6 +26,7 @@ references:
 - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
   analytic_story:
+  - Caddy Wiper
   - Data Destruction
   - Hermetic Wiper
   cis20:

detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml

@@ -28,6 +28,8 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction 
+  - Caddy Wiper
   - WhisperGate
   - Hermetic Wiper
   cis20:

stories/caddywiper.yml

@@ -0,0 +1,21 @@
+name: Caddy Wiper
+id: 435a156a-8ef1-4184-bd52-22328fb65d3a
+version: 1
+date: '2022-03-25'
+author: Teoderick Contreras, Rod Soto, Splunk
+description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions.
+narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions.
+references:
+- https://twitter.com/ESETresearch/status/1503436420886712321
+- https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/
+tags:
+  analytic_story: Caddy Wiper
+  category:
+  - Data Destruction
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/doublezerodestructor.yml

@@ -0,0 +1,21 @@
+name: Double Zero Destructor
+id: f56e8c00-3224-4955-9a6e-924ec7da1df7
+version: 1
+date: '2022-03-25'
+author: Teoderick Contreras, Rod Soto, Splunk
+description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.
+narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls.
+references:
+- https://cert.gov.ua/article/38088
+- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
+tags:
+  analytic_story: Double Zero Destructor
+  category:
+  - Data Destruction
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/hermeticwiper.yml

@@ -6,13 +6,14 @@ author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk
 description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities
   that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.
 narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting
-  multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. 
+  multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.
 references:
 - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
 - https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
 tags:
   analytic_story: Hermetic Wiper
   category:
+  - Data Destruction
   - Malware
   - Adversary Tactics
   product:

stories/whispergate.yml

@@ -4,10 +4,10 @@ version: 1
 date: '2022-01-19'
 author: Teoderick Contreras, Splunk
 description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities
-  that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic 
+  that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic
   story looks for suspicious process execution, command-line activity, downloads, DNS queries and more.
-narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting 
-  multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, 
+narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting
+  multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform,
   overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.
 references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
@@ -15,10 +15,11 @@ references:
 tags:
   analytic_story: WhisperGate
   category:
+  - Data Destruction
   - Malware
   - Adversary Tactics
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  usecase: Advanced Threat Detection
+  usecase: Advanced Threat Detection