Detects unknown disk wiper script for Linux systems

Hunt Hypothesis

This hunt detects adversary behavior where attackers deploy unauthorized scripts to execute a disk wipe operation on Linux systems, potentially erasing critical forensic evidence before detection. The SOC team should proactively hunt for this in Azure Sentinel because early identification of unknown wiper scripts prevents data loss and allows for immediate containment before the attack escalates into a full-scale system compromise.

YARA Rule

rule SUSP_LNX_SH_Disk_Wiper_Script_Jun25 {
   meta:
      description = "Detects unknown disk wiper script for Linux systems"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2025-06-19"
      score = 65
      hash1 = "f662f69fc7f4240cd8c00661db9484e76b5d02f903590140b4086fefcf9d9331"
      id = "aad68277-4889-512d-b8b3-a4c4706fbc9e"
   strings:
      $s1 = "THIS SCRIPT IS LIVE AND ARMED!" ascii fullword
      $s2 = "FAIR WARNING!" ascii fullword
      $s3 = "lists devices" ascii fullword
   condition:
      uint16(0) == 0x2123
      and filesize < 2KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

False Positive Scenarios for “Unknown Disk Wiper Script” Rule on Linux

• Scenario: Scheduled Log Rotation and Cleanup via logrotate

  • Context: The enterprise utilizes the standard logrotate utility to manage log files. When configured with aggressive retention policies (e.g., deleting logs older than 30 days), it executes shell scripts that remove large directories of historical data, which can mimic a disk wiper behavior if the volume of deleted data is significant within a short timeframe.
  • Suggested Filter/Exclusion: Exclude processes matching logrotate or scripts located in /etc/logrotate.d/. Additionally, filter out events where the parent process PID belongs to the cron service (PID 1 or specific cron daemon PIDs) and the script path contains standard log directories like /var/log/.

• Scenario: Automated Backup Pre-Processing by rsync or tar

  • Context: Daily backup jobs often include a pre-processing step where temporary staging areas are cleared to ensure sufficient disk space before the main backup begins. Tools like rsync with the --delete flag or custom bash scripts running via systemd-timer may wipe specific mount points (e.g., /mnt/backup_staging) that appear as unknown wiper scripts if not explicitly whitelisted in the rule’s known script list.
  • Suggested Filter/Exclusion: Create an exclusion for processes named rsync, tar, or systemd-tmpfiles when they operate on paths containing keywords like “backup”, “staging”, or “temp”. Specifically, exclude events where the command line arguments include flags such as --delete, -rm, or --prune-empty-dirs.

• Scenario: Container Orchestration Cleanup (Kubernetes/Docker)

  ---