Branch was auto-updated.

detections/deprecated/suspicious_powershell_command_line_arguments.yml

@@ -30,6 +30,7 @@ references: []
 tags:
   analytic_story:
   - Malicious PowerShell
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/deprecated/uncommon_processes_on_endpoint.yml

@@ -26,6 +26,7 @@ tags:
   analytic_story:
   - Windows Privilege Escalation
   - Unusual Processes
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 2

detections/endpoint/active_setup_registry_autostart.yml

@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/any_powershell_downloadfile.yml

@@ -31,6 +31,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 tags:
   analytic_story:
+  - Hermetic Wiper
   - Malicious PowerShell
   - Ingress Tool Transfer
   - Log4Shell CVE-2021-44228

detections/endpoint/any_powershell_downloadstring.yml

@@ -30,6 +30,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   - HAFNIUM Group
   - Ingress Tool Transfer

detections/endpoint/change_default_file_association.yml

@@ -31,6 +31,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
+  - Hermetic Wiper 
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -37,6 +37,7 @@ references:
 - https://github.com/BC-SECURITY/Empire
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 90
   context:

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -34,6 +34,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 100
   context:

detections/endpoint/etw_registry_disabled.yml

@@ -38,6 +38,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
+  - Hermetic Wiper 
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Windows Privilege Escalation
   - Active Directory Kerberos Attacks
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/linux_java_spawning_shell.yml

@@ -30,6 +30,7 @@ references:
 - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
 tags:
   analytic_story:
+  - Hermetic Wiper
   - Log4Shell CVE-2021-44228
   asset_type: Endpoint
   confidence: 50

detections/endpoint/logon_script_event_trigger_execution.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -40,6 +40,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   - NOBELIUM Group
   - WhisperGate

detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml

@@ -26,6 +26,7 @@ known_false_positives: These characters might be legitimately on the command-lin
 references: []
 tags:
   analytic_story:
+  - Hermetic Wiper
   - Malicious PowerShell
   asset_type: Endpoint
   cis20:

detections/endpoint/msi_module_loaded_by_non_system_binary.yml

@@ -39,6 +39,7 @@ references:
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/possible_lateral_movement_powershell_spawn.yml

@@ -37,6 +37,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Active Directory Lateral Movement
   - Malicious PowerShell
   confidence: 50

detections/endpoint/powershell_4104_hunting.yml

@@ -49,6 +49,7 @@ references:
 - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 100
   context:

detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml

@@ -36,6 +36,7 @@ references:
 - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
   - HAFNIUM Group

detections/endpoint/powershell_domain_enumeration.yml

@@ -32,6 +32,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 70
   context:

detections/endpoint/powershell_enable_smb1protocol_feature.yml

@@ -22,6 +22,7 @@ references:
 - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   - Ransomware
   context:

detections/endpoint/powershell_execute_com_object.yml

@@ -24,6 +24,7 @@ references:
 - https://threadreaderapp.com/thread/1423361119926816776.html
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   - Ransomware
   confidence: 50

detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml

@@ -35,6 +35,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper
   - Malicious PowerShell
   confidence: 80
   context:

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -34,6 +34,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 80
   context:

detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml

@@ -36,6 +36,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 80
   context:

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -27,6 +27,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 80
   context:

detections/endpoint/powershell_using_memory_as_backing_store.yml

@@ -27,6 +27,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 80
   context:

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -28,6 +28,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Ransomware
   - Malicious PowerShell
   confidence: 80

detections/endpoint/recon_using_wmi_class.yml

@@ -29,6 +29,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 80
   context:

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -40,6 +40,7 @@ tags:
   - Suspicious Windows Registry Activities
   - Cloud Federated Credential Abuse
   - Windows Registry Abuse
+  - Hermetic Wiper 
   cis20:
   - CIS 8
   confidence: 95

detections/endpoint/runas_execution_in_commandline.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/screensaver_event_trigger_execution.yml

@@ -32,6 +32,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
+  - Hermetic Wiper 
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -25,6 +25,7 @@ known_false_positives: Administrators may attempt to change the default executio
 references: []
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   - Credential Dumping
   - HAFNIUM Group

detections/endpoint/time_provider_persistence_registry.yml

@@ -39,6 +39,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
+  - Hermetic Wiper 
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/unloading_amsi_via_reflection.yml

@@ -35,6 +35,7 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 70
   context:

detections/endpoint/w3wp_spawning_shell.yml

@@ -35,6 +35,7 @@ references:
 - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
+  - Hermetic Wiper
   - HAFNIUM Group
   - ProxyShell
   confidence: 80

detections/endpoint/wmi_recon_running_process_or_services.yml

@@ -26,6 +26,7 @@ references:
 - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
 tags:
   analytic_story:
+  - Hermetic Wiper 
   - Malicious PowerShell
   confidence: 100
   context:

detections/experimental/application/email_attachments_with_lots_of_spaces.yml

@@ -32,6 +32,7 @@ known_false_positives: None at this time
 references: []
 tags:
   analytic_story:
+  - Hermetic Wiper
   - 'Emotet Malware  DHS Report TA18-201A '
   - Suspicious Emails
   asset_type: Endpoint

detections/experimental/application/suspicious_email_attachment_extensions.yml

@@ -29,6 +29,7 @@ known_false_positives: None identified
 references: []
 tags:
   analytic_story:
+  - Hermetic Wiper
   - 'Emotet Malware  DHS Report TA18-201A '
   - Suspicious Emails
   asset_type: Endpoint

detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml

@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 5

detections/experimental/endpoint/print_processor_registry_autostart.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   asset_type: Endpoint
   confidence: 100
   context: