From d41712757c765346baa4eaf56fac18408313cd96 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 2 Mar 2022 12:13:37 -0800 Subject: [PATCH] analyticstory --- stories/hermeticwiper.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 stories/hermeticwiper.yml diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml new file mode 100644 index 0000000000..885a354c60 --- /dev/null +++ b/stories/hermeticwiper.yml @@ -0,0 +1,23 @@ +name: Hermetic Wiper +id: +version: 1 +date: '2022-03-02' +author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk +description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities + that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic + story looks for abuse of Regsvr32, Executables written in administrative SMB Share, Suspcious processes, Disabling of Memory Crash DUmp and more. +narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting + multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. +references: +- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ +- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a +tags: + analytic_story: Hermetic Wiper + category: + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection