wiper unique strings

Hunt Hypothesis

This detection identifies adversary behavior associated with data destruction or anti-forensics activities by matching unique string signatures indicative of Wiper malware families within Azure Sentinel logs. Proactively hunting for these specific strings is critical to confirm early-stage wiper infections before they execute destructive payloads, ensuring the SOC team can isolate affected assets and preserve evidence prior to significant data loss.

YARA Rule

rule wiper_unique_strings
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
	 	company = "novetta"

	 strings:
	 	$a = "C!@I#%VJSIEOTQWPVz034vuA"
		$b = "BAISEO%$2fas9vQsfvx%$"
		$c = "1.2.7.f-hanba-win64-v1"
		$d = "md %s&copy %s\\*.* %s"
		$e = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
		$f = "Ge.tVol. .umeIn..for  mati.onW"
	
	condition:
		$a or $b or $c or $d or $e or $f
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the wiper_unique_strings detection rule in an enterprise environment, along with suggested filters or exclusions:

• Enterprise Endpoint Protection Scans

  • Scenario: Scheduled antivirus scans (e.g., Microsoft Defender Antivirus, CrowdStrike Falcon, or Symantec Endpoint Protection) frequently generate temporary files containing unique cryptographic hashes and UUIDs while indexing large datasets. These strings often match the “unique string” signature of wiper tools as they are written to disk in rapid succession before being deleted.
  • Filter/Exclusion: Exclude processes running under known AV service accounts (e.g., NT SERVICE\MsMpEng, svc-crowdstrike) and filter out file paths located within the vendor’s default quarantine or temporary scan directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Temp).

• Software Deployment Agents

  • Scenario: Automated patch management tools like SCCM (Configuration Manager), Ansible, or Chocolatey create unique staging folders and manifest files during deployment windows. These agents often write configuration strings with high entropy (randomized IDs) to temporary locations before extracting payloads, mimicking the behavior of a wiper tool preparing for cleanup.
  • Filter/Exclusion: Whitelist the specific executable names of deployment agents (e.g., ccmexec.exe, ansible-runner.py, choco.exe) and exclude file operations occurring within standard deployment staging paths such as %TEMP%\CCMCache or C:\ProgramData\Ansible.

• Database Maintenance Jobs

  • Scenario: Scheduled database maintenance tasks (e.g., SQL Server Agent jobs, Oracle RMAN backups) generate unique transaction logs and temporary backup manifests containing high-entropy strings. When these jobs rotate logs or truncate temporary tables, they write and delete files with unique identifiers that trigger