huntrule

Windows Process Creation: Hermetic Wiper–style Postgres/PowerShell Command-Line Patterns

Flags Windows process creation with wiper-like PowerShell comsvcs MiniDump and related command-line/paths.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-02-25
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches specific Windows process creation behaviors that align with observed Hermetic Wiper intrusion activity, including executions referencing postgresql.exe and PowerShell command lines consistent with dumping behavior. Attackers can use such patterns to stage actions, move or access files via administrative shares, and produce artifacts that support follow-on activity. The detection relies on process execution telemetry containing the executed image path and command-line arguments.

Reporting behind it

Related detections9 linkedT1021.001 — drag to rearrange
Suspicious TermService ServiceDll Hijack via Registry (via registry_set)
Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation
Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware
Malicious RDP Tunneling via ngrok (via process_creation)
Suspicious Remote Desktop Enablement via Registry By Ransomware
Suspicious Remote Desktop Enablement via netsh Firewall Rule (via process_creation)
Suspicious RDP Enablement via netsh Firewall Rule
Suspicious RDP Enablement via fDenyTSConnections Registry Modification
Suspicious RDP Enablement via fDenyTSConnections Registry Modification [Huntress] #2
Windows Process Creation: Hermetic Wiper–style Postgres/PowerShell Command-Line Patterns
Pivot detection · T1021.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.