Analytics Story: Hermetic Wiper

Updated Date: 2026-05-13 ID: b7511c2e-9a10-11ec-99e3-acde48001122 Author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk Product: Splunk Enterprise Security

Description

This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.

Why it matters

Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Email Attachments With Lots Of Spaces	Masquerade File Type, Spearphishing Attachment	Anomaly
Suspicious Email Attachment Extensions	Spearphishing Attachment	Anomaly
Powershell Fileless Process Injection via GetProcAddress	Process Injection, PowerShell	TTP
Detect Empire with PowerShell Script Block Logging	PowerShell	TTP
Windows Raw Access To Master Boot Record Drive	Disk Structure Wipe	TTP
Screensaver Event Trigger Execution	Screensaver	TTP
Recon Using WMI Class	PowerShell, Gather Victim Host Information	Anomaly
Registry Keys Used For Privilege Escalation	Image File Execution Options Injection	TTP
Executable File Written in Administrative SMB Share	SMB/Windows Admin Shares	TTP
Powershell Processing Stream Of Data	PowerShell	Anomaly
Recon AVProduct Through Pwh or WMI	Gather Victim Host Information	TTP
Overwriting Accessibility Binaries	Accessibility Features	TTP
Possible Lateral Movement PowerShell Spawn	Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, PowerShell, MMC, Windows Service	Anomaly
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP
Malicious PowerShell Process - Encoded Command	Obfuscated Files or Information	Hunting
Malicious PowerShell Process With Obfuscation Techniques	PowerShell	TTP
WMI Recon Running Process Or Services	Gather Victim Host Information	Anomaly
MSI Module Loaded by Non-System Binary	DLL	Hunting
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Windows Modify Show Compress Color And Info Tip Registry	Modify Registry	TTP
Powershell Enable SMB1Protocol Feature	Indicator Removal from Tools	TTP
Web or Application Server Spawning a Shell	External Remote Services, Exploit Public-Facing Application	TTP
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Runas Execution in CommandLine	Token Impersonation/Theft	Hunting
Windows Disable Memory Crash Dump	Data Destruction	TTP
Windows New Default File Association Value Set	Change Default File Association	Hunting
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Powershell Using memory As Backing Store	PowerShell	TTP
Set Default PowerShell Execution Policy To Unrestricted or Bypass	PowerShell	TTP
Unloading AMSI via Reflection	PowerShell, Disable or Modify Tools	TTP
Print Processor Registry Autostart	Print Processors	TTP
ETW Registry Disabled	Trusted Developer Utilities Proxy Execution, Disable or Modify Tools	TTP
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
Time Provider Persistence Registry	Time Providers	TTP
PowerShell Loading DotNET into Memory via Reflection	PowerShell	Anomaly
Detect Mimikatz With PowerShell Script Block Logging	OS Credential Dumping, PowerShell	TTP
Active Setup Registry Autostart	Active Setup	TTP
Powershell Execute COM Object	PowerShell, Component Object Model Hijacking	TTP
Windows File Without Extension In Critical Folder	Data Destruction	Anomaly
Logon Script Event Trigger Execution	Logon Script (Windows)	TTP
Windows Raw Access To Disk Volume Partition	Disk Structure Wipe	Anomaly
PowerShell 4104 Hunting	OS Credential Dumping, PowerShell, Downgrade Attack	Hunting
Kerberoasting spn request with RC4 encryption	Kerberoasting	TTP
PowerShell Domain Enumeration	PowerShell	Anomaly
Child Processes of Spoolsv exe	Exploitation for Privilege Escalation	TTP
Regsvr32 Silent and Install Param Dll Loading	Regsvr32	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 9	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata:v2`	`not_applicable`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Windows Event Log Security 4769	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 2