From 7f72193a34cf786d404633346fd26212bf2bb526 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 25 Mar 2022 13:35:13 -0700 Subject: [PATCH 1/5] fixeddatadestructiontagnewstories --- ...cmd_carry_out_string_command_parameter.yml | 1 + ...le_written_in_administrative_smb_share.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 2 ++ ...2_silent_and_install_param_dll_loading.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 2 ++ ...w_compress_color_and_info_tip_registry.yml | 1 + ...ws_raw_access_to_disk_volume_partition.yml | 1 + ...raw_access_to_master_boot_record_drive.yml | 2 ++ stories/caddywiper.yml | 23 +++++++++++++++++++ stories/doublezerodestructor.yml | 22 ++++++++++++++++++ stories/hermeticwiper.yml | 3 ++- stories/whispergate.yml | 9 ++++---- 12 files changed, 63 insertions(+), 5 deletions(-) create mode 100644 stories/caddywiper.yml create mode 100644 stories/doublezerodestructor.yml diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 6d31a47b77..7144a751a6 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -30,6 +30,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Data Destruction - IcedID - Log4Shell CVE-2021-44228 - WhisperGate diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 05ee4e8bd1..9a10c51742 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -30,6 +30,7 @@ references: - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: + - Data Destruction - Active Directory Lateral Movement - Trickbot - Hermetic Wiper diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index abaf8dcab2..a29cb171b9 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -35,6 +35,8 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Double Zero Destructor + - Data Destruction - XMRig - Remcos - WhisperGate diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 7047478d56..25a35dcb5b 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -30,6 +30,7 @@ references: - https://attack.mitre.org/techniques/T1218/010/ tags: analytic_story: + - Data Destruction - Suspicious Regsvr32 Activity - Remcos - Hermetic Wiper diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 5f1176eaf3..bb98c9ccf2 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -32,6 +32,8 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Data Destruction + - Double Zero Destructor - XMRig - Remcos - WhisperGate diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index abc36acbe0..edf27ade51 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -34,6 +34,7 @@ references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: analytic_story: + - Data Destruction - Windows Defense Evasion Tactics - Hermetic Wiper cis20: diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 446bb0cb86..6afbb6c2d8 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -26,6 +26,7 @@ references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: analytic_story: + - Caddy Wiper - Data Destruction - Hermetic Wiper cis20: diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 37a83412ca..02a0890fa9 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -28,6 +28,8 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Data Destruction + - Caddy Wiper - WhisperGate - Hermetic Wiper cis20: diff --git a/stories/caddywiper.yml b/stories/caddywiper.yml new file mode 100644 index 0000000000..98dd2eba52 --- /dev/null +++ b/stories/caddywiper.yml @@ -0,0 +1,23 @@ +name: Caddy Wiper +id: 435a156a-8ef1-4184-bd52-22328fb65d3a +version: 1 +date: '2022-03-25' +author: Teoderick Contreras, Rod Soto, Splunk +description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys +Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. +narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on +Domain Controllers and destroys boot and drive partitions. +references: +- https://twitter.com/ESETresearch/status/1503436420886712321 +- https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/ +tags: + analytic_story: Caddy Wiper + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/doublezerodestructor.yml b/stories/doublezerodestructor.yml new file mode 100644 index 0000000000..a8fb11cc7c --- /dev/null +++ b/stories/doublezerodestructor.yml @@ -0,0 +1,22 @@ +name: Double Zero Destructor +id: f56e8c00-3224-4955-9a6e-924ec7da1df7 +version: 1 +date: '2022-03-25' +author: Teoderick Contreras, Rod Soto, Splunk +description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks +or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD. +narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls. +references: +- https://cert.gov.ua/article/38088 +- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html +tags: + analytic_story: Double Zero Destructor + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml index 6e026c761b..edb0753c55 100644 --- a/stories/hermeticwiper.yml +++ b/stories/hermeticwiper.yml @@ -6,13 +6,14 @@ author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more. narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting - multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. + multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. references: - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ - https://www.cisa.gov/uscert/ncas/alerts/aa22-057a tags: analytic_story: Hermetic Wiper category: + - Data Destruction - Malware - Adversary Tactics product: diff --git a/stories/whispergate.yml b/stories/whispergate.yml index e00e92fa5a..e941ece31f 100644 --- a/stories/whispergate.yml +++ b/stories/whispergate.yml @@ -4,10 +4,10 @@ version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities - that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic + that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more. -narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting - multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, +narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting + multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ @@ -15,10 +15,11 @@ references: tags: analytic_story: WhisperGate category: + - Data Destruction - Malware - Adversary Tactics product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 6a14b4debb99d923ac125700a3ac250574e64b14 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 25 Mar 2022 17:43:22 -0700 Subject: [PATCH 2/5] stories/caddywiper.yml --- stories/caddywiper.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/caddywiper.yml b/stories/caddywiper.yml index 98dd2eba52..127e5679c4 100644 --- a/stories/caddywiper.yml +++ b/stories/caddywiper.yml @@ -3,8 +3,7 @@ id: 435a156a-8ef1-4184-bd52-22328fb65d3a version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk -description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys -Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. +description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Domain Controllers and destroys boot and drive partitions. references: From 1d5369741f350943e79774a35f07698a68c22af5 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 25 Mar 2022 18:24:16 -0700 Subject: [PATCH 3/5] fixeddescription --- stories/caddywiper.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/caddywiper.yml b/stories/caddywiper.yml index 127e5679c4..176934dd71 100644 --- a/stories/caddywiper.yml +++ b/stories/caddywiper.yml @@ -5,7 +5,7 @@ date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on -Domain Controllers and destroys boot and drive partitions. + Domain Controllers and destroys boot and drive partitions. references: - https://twitter.com/ESETresearch/status/1503436420886712321 - https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/ From 17b2044dfc3c9acff10434e05538999db526d8bd Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 25 Mar 2022 18:33:41 -0700 Subject: [PATCH 4/5] fixeddescription --- stories/caddywiper.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/caddywiper.yml b/stories/caddywiper.yml index 176934dd71..0d00ee5ad9 100644 --- a/stories/caddywiper.yml +++ b/stories/caddywiper.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. -narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on - Domain Controllers and destroys boot and drive partitions. +narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions. references: - https://twitter.com/ESETresearch/status/1503436420886712321 - https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/ From 209853dd4e815c74777735ef8efd022f21a529e8 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 25 Mar 2022 19:38:51 -0700 Subject: [PATCH 5/5] fixeddz --- stories/doublezerodestructor.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/stories/doublezerodestructor.yml b/stories/doublezerodestructor.yml index a8fb11cc7c..49de255b07 100644 --- a/stories/doublezerodestructor.yml +++ b/stories/doublezerodestructor.yml @@ -3,9 +3,8 @@ id: f56e8c00-3224-4955-9a6e-924ec7da1df7 version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk -description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks -or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD. -narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls. +description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD. +narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls. references: - https://cert.gov.ua/article/38088 - https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html