diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 6d31a47b77..7144a751a6 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -30,6 +30,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Data Destruction - IcedID - Log4Shell CVE-2021-44228 - WhisperGate diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 05ee4e8bd1..9a10c51742 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -30,6 +30,7 @@ references: - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: + - Data Destruction - Active Directory Lateral Movement - Trickbot - Hermetic Wiper diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index abaf8dcab2..a29cb171b9 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -35,6 +35,8 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Double Zero Destructor + - Data Destruction - XMRig - Remcos - WhisperGate diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 7047478d56..25a35dcb5b 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -30,6 +30,7 @@ references: - https://attack.mitre.org/techniques/T1218/010/ tags: analytic_story: + - Data Destruction - Suspicious Regsvr32 Activity - Remcos - Hermetic Wiper diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 5f1176eaf3..bb98c9ccf2 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -32,6 +32,8 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Data Destruction + - Double Zero Destructor - XMRig - Remcos - WhisperGate diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 35104fa672..c7538027c5 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -34,6 +34,7 @@ references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: analytic_story: + - Data Destruction - Windows Defense Evasion Tactics - Hermetic Wiper - Windows Registry Abuse diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 446bb0cb86..6afbb6c2d8 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -26,6 +26,7 @@ references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: analytic_story: + - Caddy Wiper - Data Destruction - Hermetic Wiper cis20: diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 37a83412ca..02a0890fa9 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -28,6 +28,8 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Data Destruction + - Caddy Wiper - WhisperGate - Hermetic Wiper cis20: diff --git a/stories/caddywiper.yml b/stories/caddywiper.yml new file mode 100644 index 0000000000..0d00ee5ad9 --- /dev/null +++ b/stories/caddywiper.yml @@ -0,0 +1,21 @@ +name: Caddy Wiper +id: 435a156a-8ef1-4184-bd52-22328fb65d3a +version: 1 +date: '2022-03-25' +author: Teoderick Contreras, Rod Soto, Splunk +description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. +narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions. +references: +- https://twitter.com/ESETresearch/status/1503436420886712321 +- https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/ +tags: + analytic_story: Caddy Wiper + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/doublezerodestructor.yml b/stories/doublezerodestructor.yml new file mode 100644 index 0000000000..49de255b07 --- /dev/null +++ b/stories/doublezerodestructor.yml @@ -0,0 +1,21 @@ +name: Double Zero Destructor +id: f56e8c00-3224-4955-9a6e-924ec7da1df7 +version: 1 +date: '2022-03-25' +author: Teoderick Contreras, Rod Soto, Splunk +description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD. +narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls. +references: +- https://cert.gov.ua/article/38088 +- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html +tags: + analytic_story: Double Zero Destructor + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml index 6e026c761b..edb0753c55 100644 --- a/stories/hermeticwiper.yml +++ b/stories/hermeticwiper.yml @@ -6,13 +6,14 @@ author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more. narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting - multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. + multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. references: - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ - https://www.cisa.gov/uscert/ncas/alerts/aa22-057a tags: analytic_story: Hermetic Wiper category: + - Data Destruction - Malware - Adversary Tactics product: diff --git a/stories/whispergate.yml b/stories/whispergate.yml index e00e92fa5a..e941ece31f 100644 --- a/stories/whispergate.yml +++ b/stories/whispergate.yml @@ -4,10 +4,10 @@ version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities - that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic + that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more. -narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting - multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, +narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting + multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ @@ -15,10 +15,11 @@ references: tags: analytic_story: WhisperGate category: + - Data Destruction - Malware - Adversary Tactics product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection