Windows NotPetya Activity: wevtutil Log Clearing and Drive C USN Delete via fsutil

title: "Windows NotPetya Activity: wevtutil Log Clearing and Drive C USN Delete via fsutil"
id: 0333b420-966f-488d-95a1-b0be0c57749d
status: test
description: This rule identifies NotPetya-like ransomware behavior on Windows where a command clears Windows event logs using wevtutil and deletes the NTFS change journal on drive C using fsutil usn deletejournal. It also looks for execution patterns consistent with data passed through a rundll32 .dat payload and a named pipe-related module interaction. The detection relies on process creation telemetry, matching specific command-line strings and rundll32 execution parameters.
references:
  - https://securelist.com/schroedingers-petya/78870/
  - https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml
author: Florian Roth (Nextron Systems), Tom Ueltschi, Huntrule Team
date: 2019-01-16
modified: 2022-12-15
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1218.011
  - attack.t1685.005
  - attack.credential-access
  - attack.t1003.001
  - car.2016-04-002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_specific_pattern:
    CommandLine|contains:
      - "wevtutil cl Application & fsutil usn deletejournal /D C:"
      - dllhost.dat %WINDIR%\ransoms
  selection_rundll32:
    Image|endswith: \rundll32.exe
    CommandLine|endswith:
      - .dat,#1
      - ".dat #1"
      - .zip.dll",#1
  selection_perfc_keyword:
    - \perfc.dat
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
    type: derived