Analytics Story: Hermetic Wiper

Created: 2022-03-02 Last Updated: 2026-05-13 ID: b7511c2e-9a10-11ec-99e3-acde48001122 Author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk Product: Splunk Enterprise Security

Description

This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.

Why it matters

Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Registry Keys Used For Privilege Escalation	Image File Execution Options Injection	TTP
Runas Execution in CommandLine	Token Impersonation/Theft	Hunting
Logon Script Event Trigger Execution	Logon Script (Windows)	TTP
Email Attachments With Lots Of Spaces	Masquerade File Type, Spearphishing Attachment	Anomaly
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
ETW Registry Disabled	Trusted Developer Utilities Proxy Execution, Disable or Modify Tools	TTP
Powershell Enable SMB1Protocol Feature	Indicator Removal from Tools	TTP
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Windows Disable Memory Crash Dump	Data Destruction	TTP
Windows Raw Access To Master Boot Record Drive	Disk Structure Wipe	TTP
Child Processes of Spoolsv exe	Exploitation for Privilege Escalation	TTP
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP
Powershell Fileless Process Injection via GetProcAddress	Process Injection, PowerShell	TTP
Regsvr32 Silent and Install Param Dll Loading	Regsvr32	Anomaly
Malicious PowerShell Process With Obfuscation Techniques	PowerShell	TTP
Possible Lateral Movement PowerShell Spawn	Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, PowerShell, MMC, Windows Service	Anomaly
PowerShell Domain Enumeration	PowerShell	Anomaly
Overwriting Accessibility Binaries	Accessibility Features	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe	Anomaly
PowerShell Loading DotNET into Memory via Reflection	PowerShell	Anomaly
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
Powershell Processing Stream Of Data	PowerShell	Anomaly
Detect Mimikatz With PowerShell Script Block Logging	OS Credential Dumping, PowerShell	TTP
Screensaver Event Trigger Execution	Screensaver	TTP
Print Processor Registry Autostart	Print Processors	TTP
Active Setup Registry Autostart	Active Setup	TTP
Set Default PowerShell Execution Policy To Unrestricted or Bypass	PowerShell	TTP
Windows File Without Extension In Critical Folder	Data Destruction	Anomaly
Executable File Written in Administrative SMB Share	SMB/Windows Admin Shares	TTP
Powershell Execute COM Object	PowerShell, Component Object Model Hijacking	TTP
Time Provider Persistence Registry	Time Providers	TTP
Malicious PowerShell Process - Encoded Command	Obfuscated Files or Information	Hunting
Windows New Default File Association Value Set	Change Default File Association	Hunting
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Windows Modify Show Compress Color And Info Tip Registry	Modify Registry	TTP
Unloading AMSI via Reflection	PowerShell, Disable or Modify Tools	TTP
Kerberoasting spn request with RC4 encryption	Kerberoasting	TTP
Recon AVProduct Through Pwh or WMI	Gather Victim Host Information	TTP
Web or Application Server Spawning a Shell	External Remote Services, Exploit Public-Facing Application	TTP
Recon Using WMI Class	PowerShell, Gather Victim Host Information	Anomaly
MSI Module Loaded by Non-System Binary	DLL	Hunting
Powershell Using memory As Backing Store	PowerShell	TTP
WMI Recon Running Process Or Services	Gather Victim Host Information	Anomaly
Detect Empire with PowerShell Script Block Logging	PowerShell	TTP
PowerShell 4104 Hunting	OS Credential Dumping, PowerShell, Downgrade Attack	Hunting
Suspicious Email Attachment Extensions	Spearphishing Attachment	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata:v2`	`not_applicable`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 9	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4769	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

Source: GitHub | Version: 2