Detections

Analysis of GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

GigaWiper Direct Raw Disk Access

sigma · generated; parse required before publication

title: GigaWiper Direct Raw Disk Access
description: Detects unauthorized processes requesting raw access to physical drive
  devices.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    process.command_line: wevtutil.exe cl
  condition: selection
level: medium
tags: []
references: []

malware_gigawiper_bluerabbit

yara · compile required before publication

rule malware_gigawiper_bluerabbit {
  strings:
    $s1 = "BLUERABBIT_CORE" ascii wide nocase
    $s2 = "GIGAWIPER_SECTOR_OVERWRITE" ascii wide nocase
  condition:
    any of them
}