Windows process patterns indicating Hermetic wiper-style execution and PowerShell usage

title: Windows process patterns indicating Hermetic wiper-style execution and PowerShell usage
id: b236980b-4241-4a19-b549-6fdf84aba6cc
status: test
description: This rule looks for specific Windows process execution patterns that align with wiper-style intrusion activity. It matches command-line characteristics consistent with PowerShell launching comsvcs.dll MiniDump operations and writes to remote administrative shares, and it also keys on a process image path ending with \policydefinitions\postgresql.exe. Telemetry relies on Windows process creation events including the executing image path and full command line.
references:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Hermetic-Wiper/proc_creation_win_malware_hermetic_wiper_activity.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2022-09-09
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1021.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image|endswith: \policydefinitions\postgresql.exe
  selection2:
    - CommandLine|contains:
        - CSIDL_SYSTEM_DRIVE\temp\sys.tmp
        - " 1> \\\\\\\\127.0.0.1\\ADMIN$\\__16"
    - CommandLine|contains|all:
        - "powershell -c "
        - "\\comsvcs.dll MiniDump "
        - \winupd.log full
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2f974656-6d83-4059-bbdf-68ac5403422f
    type: derived