From edb7b2d6f5298732b76e0c8a430acb799bd76ca6 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Thu, 12 Feb 2026 11:56:31 +0100 Subject: [PATCH 1/3] dynowiper --- ...s_or_script_creation_in_suspicious_path.yml | 6 ++++-- .../endpoint/modification_of_wallpaper.yml | 5 +++-- .../rubeus_command_line_parameters.yml | 5 +++-- ..._ticket_exports_through_winlogon_access.yml | 5 +++-- .../windows_high_file_deletion_frequency.yml | 6 ++++-- .../windows_indicator_removal_via_rmdir.yml | 5 +++-- .../windows_system_shutdown_commandline.yml | 5 +++-- stories/dynowiper.yml | 18 ++++++++++++++++++ stories/zovwiper.yml | 18 ++++++++++++++++++ 9 files changed, 59 insertions(+), 14 deletions(-) create mode 100644 stories/dynowiper.yml create mode 100644 stories/zovwiper.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index bc26c2ba3b..162ad46202 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 22 -date: '2026-01-20' +version: 23 +date: '2026-02-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -44,6 +44,7 @@ search: | "*\\Windows\\repair\\*", "*\\Windows\\servicing\\*", "*Recycle.bin*", + "*:\\inetpub\\*" ) by Filesystem.action Filesystem.dest Filesystem.file_access_time @@ -151,6 +152,7 @@ tags: - Lokibot - Castle RAT - SesameOp + - DynoWiper asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index ea05f5a463..de69837c94 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -1,7 +1,7 @@ name: Modification Of Wallpaper id: accb0712-c381-11eb-8e5b-acde48001122 -version: 7 -date: '2025-05-02' +version: 8 +date: '2026-01-12' author: Teoderick Contreras, Splunk status: production type: TTP @@ -63,6 +63,7 @@ tags: - Windows Registry Abuse - Black Basta Ransomware - Ransomware + - ZOVWiper asset_type: Endpoint mitre_attack_id: - T1491 diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 4cec230565..cef4523f07 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -1,7 +1,7 @@ name: Rubeus Command Line Parameters id: cca37478-8377-11ec-b59a-acde48001122 -version: 9 -date: '2025-10-14' +version: 10 +date: '2026-02-12' author: Mauricio Velazco, Splunk status: production type: TTP @@ -80,6 +80,7 @@ tags: - Active Directory Kerberos Attacks - BlackSuit Ransomware - Scattered Lapsus$ Hunters + - ZOVWiper asset_type: Endpoint mitre_attack_id: - T1550.003 diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 2df998fb72..75a00da16e 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -1,7 +1,7 @@ name: Rubeus Kerberos Ticket Exports Through Winlogon Access id: 5ed8c50a-8869-11ec-876f-acde48001122 -version: 10 -date: '2025-10-14' +version: 11 +date: '2026-02-12' author: Mauricio Velazco, Splunk status: production type: TTP @@ -65,6 +65,7 @@ tags: - Active Directory Kerberos Attacks - BlackSuit Ransomware - Scattered Lapsus$ Hunters + - ZOVWiper asset_type: Endpoint mitre_attack_id: - T1550.003 diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 9ca0bf76d7..bccb732fd4 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -1,7 +1,7 @@ name: Windows High File Deletion Frequency id: 45b125c4-866f-11eb-a95a-acde48001122 -version: 10 -date: '2025-09-18' +version: 11 +date: '2026-02-12' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -80,6 +80,8 @@ tags: - Interlock Ransomware - NailaoLocker Ransomware - APT37 Rustonotto and FadeStealer + - DynoWiper + - ZOVWiper asset_type: Endpoint mitre_attack_id: - T1485 diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml index 6074c402fb..0ee5e5068c 100644 --- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml +++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml @@ -1,7 +1,7 @@ name: Windows Indicator Removal Via Rmdir id: c4566d2c-b094-48a1-9c59-d66e22065560 -version: 7 -date: '2025-09-18' +version: 8 +date: '2026-02-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -64,6 +64,7 @@ tags: analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer + - ZOVWiper asset_type: Endpoint mitre_attack_id: - T1070 diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index a1bde15950..fc90c4f51e 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -1,7 +1,7 @@ name: Windows System Shutdown CommandLine id: 4fee57b8-d825-4bf3-9ea8-bf405cdb614c -version: 10 -date: '2025-10-14' +version: 11 +date: '2026-02-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -72,6 +72,7 @@ tags: - DarkCrystal RAT - MoonPeak - Scattered Lapsus$ Hunters + - ZOVWiper asset_type: Endpoint mitre_attack_id: - T1529 diff --git a/stories/dynowiper.yml b/stories/dynowiper.yml new file mode 100644 index 0000000000..2606a676fc --- /dev/null +++ b/stories/dynowiper.yml @@ -0,0 +1,18 @@ +name: DynoWiper +id: 46eceaa1-8d16-4ebd-848d-d8c1816bb1a0 +version: 1 +status: production +date: '2026-02-12' +author: Teoderick Contreras, Splunk +description: DynoWiper is a newly documented data-wiping malware identified by ESET researchers during a destructive cyber incident targeting an energy company in a critical infrastructure. Designed to overwrite files and force a system reboot, DynoWiper erases data across removable and fixed drives, rendering systems inoperable if unprotected. ESET attributes the malware to the Russia-aligned threat group Sandworm with medium confidence, noting shared tactics and coding patterns with previous destructive wiper families like ZOV. Endpoint defenses successfully blocked execution, highlighting the need for robust detection. +narrative: In late December 2025, ESET responded to a destructive malware incident involving a previously unseen wiper dubbed DynoWiper deployed within an energy sector environment. Analysis revealed a dedicated file-overwriting payload that systematically targeted drives and rebooted systems to complete destruction. Drawing parallels to prior Sandworm wiper operations such as ZOV. +references: + - https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/ +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/zovwiper.yml b/stories/zovwiper.yml new file mode 100644 index 0000000000..7a52bffb71 --- /dev/null +++ b/stories/zovwiper.yml @@ -0,0 +1,18 @@ +name: ZOVWiper +id: 3dfd6bc2-8f98-42dd-945c-d6ab5995a3e4 +version: 1 +date: '2026-02-12' +author: Teoderick Contreras, Splunk +status: production +description: ZOVWiper is a destructive data-wiping malware identified by ESET researchers, attributed to the threat group Sandworm with high confidence. First observed in November 2025 targeting a financial institution and later in an energy sector incident, ZOVWiper systematically iterates over fixed drives and overwrites file contents to destroy data irrecoverably. The malware skips key system directories and uses size-based overwrite logic to maximize destructive impact. Its deployment highlights ongoing destructive operations against critical infrastructure and financial entities. +narrative: In late 2025, ESET researchers uncovered ZOVWiper during incident response to a destructive malware attack against a financial organization. ZOVWiper’s core function is to traverse all fixed drives, selectively overwrite file contents based on size, and render systems inoperable—a characteristic pattern tied to destructive campaigns by Sandworm. The malware’s directory exclusions and wiping methodology were later noted as technical parallels to other destructive tools such as DynoWiper, reinforcing attribution confidence. ZOVWiper’s operational use against both financial and energy sector targets underscores sustained threat actor focus on disrupting critical functions through targeted data destruction. +references: +- https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/ +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 28c88cab1309db190f1271629c20de64406a88c3 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 17 Feb 2026 20:36:44 +0100 Subject: [PATCH 2/3] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 48d10447f9..52b8d4f35a 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,11 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 version: 23 -<<<<<<< dynowiper date: '2026-02-12' -======= -date: '2026-02-03' ->>>>>>> develop author: Teoderick Contreras, Splunk status: production type: Anomaly From 2936e065980d16e6645017d8d25df7ff3a5f630a Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 17 Feb 2026 23:38:38 +0100 Subject: [PATCH 3/3] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 52b8d4f35a..a89e1b5a6d 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -152,11 +152,8 @@ tags: - Lokibot - Castle RAT - SesameOp -<<<<<<< dynowiper - DynoWiper -======= - XML Runner Loader ->>>>>>> develop asset_type: Endpoint mitre_attack_id: - T1036