Detects unknown disk wiper first spotted in June 2025 and uploaded from Israel

Hunt Hypothesis

This hunt hypothesis targets a novel disk-wiping adversary originating from Israel that executes destructive operations to erase critical data storage, potentially signaling an advanced persistent threat or ransomware precursor. Proactive hunting in Azure Sentinel is essential to identify early-stage indicators of this June 2025 variant before widespread deployment causes irreversible data loss and operational disruption across the organization’s cloud infrastructure.

YARA Rule

rule MAL_WIPER_Unknown_Jun25 {
   meta:
      description = "Detects unknown disk wiper first spotted in June 2025 and uploaded from Israel"
      author = "Florian Roth"
      reference = "https://x.com/cyb3rops/status/1935707307805134975"
      date = "2025-06-19"
      score = 75
      hash1 = "12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721"
      id = "ceb2b80f-6bc3-555a-b1c8-003f380533e5"
   strings:
      $x1 = "\\CWipeNew\\Release\\" ascii fullword

      $s1 = "Failed to get disk geometry: " wide fullword
      $s2 = "--- Working on " wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 200KB
      and (
         1 of ($x*)
         or all of ($s*)
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Unknown Disk Wiper” detection rule, including suggested filters or exclusions:

Scenario: Scheduled Antivirus Quarantine and Cleanup
- Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint often run scheduled deep scans that isolate and permanently delete large numbers of files, mimicking a “wiper” behavior by modifying the disk structure.
- Suggested Filter/Exclusion: Create an exclusion rule based on the process name (e.g., FalconSensor.exe, MsMpEng.exe) and restrict the alert to only trigger if the source IP is not within the internal corporate subnet or if the execution time falls outside the standard maintenance window (e.g., 02:00–04:00 UTC).
Scenario: Automated Backup Retention Policy Execution
- Context: Data management tools such as Veeam Backup & Replication or Commvault execute nightly jobs that archive and purge old data blocks from the disk. This mass deletion activity can be misinterpreted as a malicious wiper sweeping through the file system.
- Suggested Filter/Exclusion: Exclude alerts where the initiating process matches known backup service accounts (e.g., vss.exe, commagent.exe) and the action occurs during the defined “Backup Window” configured in the GPO or scheduler task.
Scenario: IT Admin Disk Cleanup via PowerShell Scripts
- Context: System administrators frequently run custom PowerShell scripts (e.g., using Remove-Item cmdlets) to clean up temporary folders, old logs, or decommissioned user profiles during change management windows. These scripts often perform bulk deletion operations that look like a wiper attack.