Analytics Story: Hermetic Wiper

Updated Date: 2026-05-13 ID: b7511c2e-9a10-11ec-99e3-acde48001122 Author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk Product: Splunk Enterprise Security

Description

This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.

Why it matters

Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Powershell Using memory As Backing Store	PowerShell	TTP
Windows Disable Memory Crash Dump	Data Destruction	TTP
Time Provider Persistence Registry	Time Providers	TTP
Malicious PowerShell Process - Encoded Command	Obfuscated Files or Information	Hunting
Web or Application Server Spawning a Shell	External Remote Services, Exploit Public-Facing Application	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe	Anomaly
Detect Mimikatz With PowerShell Script Block Logging	OS Credential Dumping, PowerShell	TTP
Child Processes of Spoolsv exe	Exploitation for Privilege Escalation	TTP
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Recon AVProduct Through Pwh or WMI	Gather Victim Host Information	TTP
Print Processor Registry Autostart	Print Processors	TTP
Email Attachments With Lots Of Spaces	Masquerade File Type, Spearphishing Attachment	Anomaly
MSI Module Loaded by Non-System Binary	DLL	Hunting
Powershell Processing Stream Of Data	PowerShell	Anomaly
Logon Script Event Trigger Execution	Logon Script (Windows)	TTP
PowerShell Loading DotNET into Memory via Reflection	PowerShell	Anomaly
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Regsvr32 Silent and Install Param Dll Loading	Regsvr32	Anomaly
Executable File Written in Administrative SMB Share	SMB/Windows Admin Shares	TTP
PowerShell 4104 Hunting	OS Credential Dumping, PowerShell, Downgrade Attack	Hunting
Powershell Enable SMB1Protocol Feature	Indicator Removal from Tools	TTP
Registry Keys Used For Privilege Escalation	Image File Execution Options Injection	TTP
Active Setup Registry Autostart	Active Setup	TTP
Powershell Execute COM Object	PowerShell, Component Object Model Hijacking	TTP
Screensaver Event Trigger Execution	Screensaver	TTP
Windows Modify Show Compress Color And Info Tip Registry	Modify Registry	TTP
Detect Empire with PowerShell Script Block Logging	PowerShell	TTP
Recon Using WMI Class	PowerShell, Gather Victim Host Information	Anomaly
ETW Registry Disabled	Trusted Developer Utilities Proxy Execution, Disable or Modify Tools	TTP
Possible Lateral Movement PowerShell Spawn	Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, PowerShell, MMC, Windows Service	Anomaly
Runas Execution in CommandLine	Token Impersonation/Theft	Hunting
Windows File Without Extension In Critical Folder	Data Destruction	Anomaly
Suspicious Email Attachment Extensions	Spearphishing Attachment	Anomaly
Windows Raw Access To Master Boot Record Drive	Disk Structure Wipe	TTP
Unloading AMSI via Reflection	PowerShell, Disable or Modify Tools	TTP
Kerberoasting spn request with RC4 encryption	Kerberoasting	TTP
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Set Default PowerShell Execution Policy To Unrestricted or Bypass	PowerShell	TTP
Windows New Default File Association Value Set	Change Default File Association	Hunting
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
Overwriting Accessibility Binaries	Accessibility Features	TTP
PowerShell Domain Enumeration	PowerShell	Anomaly
WMI Recon Running Process Or Services	Gather Victim Host Information	Anomaly
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP
Powershell Fileless Process Injection via GetProcAddress	Process Injection, PowerShell	TTP
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Malicious PowerShell Process With Obfuscation Techniques	PowerShell	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 9	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4769	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata:v2`	`not_applicable`

References

Source: GitHub | Version: 2