Detects Wiper used by the Iranian DruidFly group

Hunt Hypothesis

This hunt hypothesis targets the deployment of a wiper malware variant associated with the Iranian DruidFly group to identify early-stage destructive attacks that erase system data and disrupt operations. Proactively hunting for this behavior in Azure Sentinel is essential because wipers often serve as a final-stage tactic in advanced persistent threats, allowing the SOC team to mitigate total data loss before it impacts critical infrastructure.

YARA Rule

rule APT_MAL_IR_DruidFly_Wiper_Jun25 {
   meta:
      description = "Detects Wiper used by the Iranian DruidFly group"
      author = "Florian Roth"
      reference = "https://x.com/threatintel/status/1936049254432231444"
      date = "2025-06-21"
      score = 80
      hash1 = "81eb22828306f3197b35fef2035cef2c548f587f8511902852964850023389d7"
      id = "4d731d9a-6f35-51a3-84de-5aa33114b75c"
   strings:
      $xc1 = { 2E 62 61 63 6B 75 70 00 2E 63 6F 6E 66 69 67 00   // .backup .config
               2E 64 62 00 00 00 00 00 2E 73 71 6C 69 74 65 00 } // // .db.... .sqlite
      $xc2 = { 00 5C 5C 2E 5C 25 63 3A 00 25 63 3A 5C 00 00 00
               00 4E 54 46 53 00 00 00 00 5C }  // \\.\%c: %c:\0\0\0 NTFS\0\0\0\

      $x1 = "%s:%d:%s(): [+] Overwriting \"%s\" \"..." ascii

      $s1 = "C:\\Windows\\System32\\drivers\\beep.sys" ascii fullword
      $s2 = "\\DosDevices\\sectorio" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 2000KB
      and ( 
         1 of ($x*)
         or 2 of them
      )
      or 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects Wiper used by the Iranian DruidFly group” rule, including suggested filters and exclusions:

Scenario: Enterprise Backup Agents Performing Full Volume Scrubs
- Context: Legacy backup solutions like Veeam Backup & Replication or Rubrik often execute full volume scans that trigger massive file deletion events (wiping old snapshots) to reclaim storage space. These actions mimic the “massive data destruction” signature of a wiper attack.
- Filter/Exclusion: Exclude processes running under the service accounts VeeamBackupService or RubrikAgent. Additionally, filter out events where the source process path contains \Program Files\Veeam\ or \Program Files\Rubrik\ and the operation type is specifically “Snapshot Deletion” rather than arbitrary file deletion.
Scenario: Scheduled Disk Cleanup Jobs via Windows Task Scheduler
- Context: IT administrators frequently schedule Windows Task Scheduler jobs (e.g., C:\Windows\System32\schtasks.exe) to run nightly disk cleanup scripts using tools like Storage Sense or custom PowerShell scripts (Clean-Volume.ps1). These jobs often wipe temporary folders and log files in bulk, generating high-volume deletion events.
- Filter/Exclusion: Create an exclusion for the parent process svchost.exe (specifically the ScheduleService) when the command line arguments contain keywords like “cleanup,” “temp,” or “maintenance.” Filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Endpoint Detection and Response (EDR) Quarantine Actions
- Context: Security tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne automatically