Analytics Story: Graceful Wipe Out Attack

Updated Date: 2026-05-13 ID: 83b15b3c-6bda-45aa-a3b6-b05c52443f44 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive attack or campaign found by "THE DFIR Report" that uses Truebot, FlawedGrace and MBR killer malware. This analytic story looks for suspicious dropped files, cobalt strike execution, im-packet execution, registry modification, scripts, persistence, lateral movement, impact, exfiltration and recon.

Why it matters

Graceful Wipe Out Attack is a destructive malware campaign found by "The DFIR Report" targeting multiple organizations to collect, exfiltrate and wipe the data of targeted networks. This malicious payload corrupts or wipes Master Boot Records by using an NSIS script after the exfiltration of sensitive information from the targeted host or system.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Service Stop Attempt	Service Stop	Hunting
Suspicious SearchProtocolHost no Command Line Arguments	Process Injection	TTP
Suspicious DLLHost no Command Line Arguments	Process Injection	TTP
Windows Excessive Usage Of Net App	Account Access Removal	Anomaly
CMD Echo Pipe - Escalation	Windows Command Shell, Windows Service	TTP
Windows Suspicious C2 Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	TTP
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Windows AdFind Exe	Remote System Discovery	TTP
SearchProtocolHost with no Command Line with Network	Process Injection	TTP
GPUpdate with no Command Line Arguments with Network	Process Injection	TTP
SecretDumps Offline NTDS Dumping Tool	NTDS	TTP
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Windows Raw Access To Master Boot Record Drive	Disk Structure Wipe	TTP
Suspicious Rundll32 no Command Line Arguments	Rundll32	TTP
Anomalous usage of 7zip	Archive via Utility	Anomaly
Suspicious Rundll32 StartW	Rundll32	TTP
Suspicious GPUpdate no Command Line Arguments	Process Injection	TTP
Windows Group Discovery Via Net	Local Groups, Domain Groups	Hunting
Services Escalate Exe	Abuse Elevation Control Mechanism	TTP
Remote WMI Command Attempt	Windows Management Instrumentation	TTP
Rundll32 with no Command Line Arguments with Network	Rundll32	TTP
Windows Office Product Spawned Rundll32 With No DLL	Spearphishing Attachment	TTP
Impacket Lateral Movement smbexec CommandLine Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Impacket Lateral Movement WMIExec Commandline Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe	Anomaly
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Windows Process Injection Remote Thread	Portable Executable Injection	TTP
Detect Regsvr32 Application Control Bypass	Regsvr32	TTP
DLLHost with no Command Line Arguments with Network	Process Injection	TTP
Suspicious microsoft workflow compiler rename	Rename Legitimate Utilities, Trusted Developer Utilities Proxy Execution	Hunting
SAM Database File Access Attempt	Security Account Manager	Hunting
Windows User Deletion Via Net	Account Access Removal	Anomaly
Windows Attempt To Stop Security Service	Disable or Modify Tools	TTP
Impacket Lateral Movement Commandline Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Suspicious MSBuild Rename	Rename Legitimate Utilities, MSBuild	Hunting
Windows Service Stop By Deletion	Service Stop	Hunting
Windows Suspicious Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	TTP
Suspicious msbuild path	Rename Legitimate Utilities, MSBuild	TTP
Executable File Written in Administrative SMB Share	SMB/Windows Admin Shares	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 9	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 8	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4663	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

Source: GitHub | Version: 2