wiper encoded strings

Hunt Hypothesis

This detection identifies adversaries employing Wiper malware that utilize specific encoded string patterns to execute destructive payloads and evade signature-based defenses. Proactively hunting for these artifacts in Azure Sentinel is critical to validate early-stage infection indicators before they escalate into widespread data destruction events across the cloud environment.

YARA Rule

rule wiper_encoded_strings
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
 		company = "novetta"

	 strings:
	 	$scr = {89 D4 C4 D5 00 00 00}
	 	$explorer = {E2 DF D7 CB C8 D5 C2 D5 89 C2 DF C2 00 00 00 }
	 	$kernel32 = {CC C2 D5 C9 C2 CB 94 95  89 C3 CB CB 00 00 }

	condition:
		$scr or $explorer or $kernel32 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the wiper_encoded_strings detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Windows Scheduled Task Execution of Backup Scripts

  • Context: Enterprise backup solutions like Veeam Agent, Commvault, or custom PowerShell scripts often execute scheduled tasks that generate temporary encoded strings (Base64) in memory to handle credentials or configuration data before writing logs. These strings frequently match the entropy and character distribution patterns of Wiper malware.
  • Suggested Filter: Exclude processes running under the SYSTEM account or specific service accounts (e.g., DOMAIN\svc_backup) where the parent process is TaskScheduler.exe. Additionally, filter out paths located in standard backup directories such as C:\Program Files\Veeam\ or C:\Windows\System32\Tasks\*.xml.

• Scenario: Microsoft Office 365 ProPlus Auto-Update and Telemetry

  • Context: The Microsoft Office Click-to-Run Service (OfficeClickToRun.exe) frequently processes large JSON payloads containing encoded strings for license validation, telemetry data, and update manifests. During the initial installation or major version updates, these services spawn child processes that manipulate high-entropy strings in memory, mimicking the behavior of a wiper encoding its payload.
  • Suggested Filter: Create an exclusion rule for the executable path C:\Program Files\Microsoft Office*\root\Office16\* and specifically target the process name OfficeClickToRun.exe. Exclude events where the command line contains arguments related to telemetry (e.g., /telemetry, /update) or specific update GUIDs.

• Scenario: Endpoint Detection and Response (EDR) Agent Scans

  • Context: Security agents such as CrowdStrike Falcon, **Sentinel