Detects suspicious Python based executable with similarities to a known disk wiper

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying custom Python-based executables that mimic the behavior of known disk wipers to potentially destroy critical data or evade detection through obfuscation. Proactive hunting for this pattern in Azure Sentinel is essential because disk-wiping attacks can cause irreversible service disruption, and identifying these specific Python artifacts early allows the SOC team to isolate affected systems before data loss occurs.

YARA Rule

rule SUSP_PY_PYInstaller_Swiper_Jun25 {
   meta:
      description = "Detects suspicious Python based executable with similarities to a known disk wiper"
      author = "Florian Roth"
      reference = "https://x.com/cyb3rops/status/1935707307805134975"
      date = "2025-06-19"
      score = 65
      hash1 = "4f669ecbe12e95d51f37be76933de4c2626d20bb01729086ce2efc603c4ffdf3"
      id = "049587a8-275d-59a6-bfbd-b72173d21a73"
   strings:
      $a1 = "bzlib1.dll" ascii fullword
      $a2 = "VCRUNTIME140_1.dll" wide fullword
      $a3 = "%s%c%s.exe" ascii fullword

      $sc1 = { 73 77 69 70 65 72 00 00 00 } // "swiper\0\0\0"
   condition:
      uint16(0) == 0x5a4d
      and filesize < 40000KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://x.com/cyb3rops/status/1935707307805134975
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects suspicious Python based executable with similarities to a known disk wiper,” including tailored filters and exclusions:

• Automated Backup Verification Scripts

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize custom python.exe scripts to verify data integrity or manage temporary cache files. These scripts may iterate through large directories and perform file deletion operations that mimic the behavior of a disk wiper.
  • Filter/Exclusion: Exclude processes where the parent process is the backup service (e.g., veeam.service, commvault.exe) AND the command line contains specific keywords like --verify or --cleanup.

• Software Deployment and Patching Agents

  • Scenario: Configuration management tools like Ansible, Puppet, or SCCM utilize Python-based agents to deploy patches. During a “reboot required” phase, these agents often execute cleanup routines that remove old update logs and temporary installation folders, triggering the disk wiper signature.
  • Filter/Exclusion: Create an exclusion for python.exe instances where the image path is located within the vendor’s specific installation directory (e.g., C:\Program Files\Ansible\bin\) AND the user context is a dedicated service account (e.g., DOMAIN\svc_ansible).

• Scheduled Data Retention and Archiving Jobs

  • Scenario: IT departments often schedule nightly Python jobs to archive old logs or rotate database files. These jobs frequently involve reading metadata and deleting files older than X days, which generates high I/O activity similar to a wiper tool.
  • Filter/Exclusion: Filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the executable hash matches a known