| Description | This article describes how to use a custom event handler in FortiAnalyzer to raise alerts for incident response related to attacks that attempt to leverage the HermeticWiper virus. |
| Scope | This event handler and report help to detect attempts to leverage the HermeticWiper virus to DDOS and wipe the target's disks based on logs from FortiGates, FortiADC, FortiClient, and FortiProxy. |
| Solution |
This data wiper malware was first discovered on machines across multiple Ukranian organizations. It is also known as 'HermeticWiper' due to it's digital certificate. The malware will disable the Volume Shadow Copy Service (VSS) and modify registry keys to disable crash dumps. It will also adjust token privileges to enable SeBackupPrivilege. It will then traverse through the physical drives, from 0 to 100, and partitions on the victim machine to destroy the data. Upon reboot, a message will appear stating that there is an error loading the operating system.
For more information about this attack, see the following FortiGuard Outbreak Alert: FortiGuard Outbreak Alert: HermeticWiper Malware
What is included in Fortinet_HermeticWiper_Malware.zip?
1) HermeticWiper Malware_event-handler.json This event handler helps identify HermeticWiper malware detected by FortiGates, FortiADC, FortiClient, and FortiProxy logs.
2) HermeticWiper Malware_report.dat This report displays the findings on HermeticWiper attacks from FortiGates, FortiADC, FortiClient, and FortiProxy logs.
3) fgt_HermeticWiper Malware_event-handler.json The event handler for FortiGate ADOMs is configured for FortiGate logs only.
4) fgt_HermeticWiper Malware_report.dat The report for FortiGate ADOMs includes FortiGate charts only.
All screenshots provided below for illustration purposes are taken from FortiAnalyzer 7.0.3.
1) Download the Fortinet_HermeticWiper_Malware.zip file (contains 4 files).
2) Unzip Fortinet_HermeticWiper_Malware.zip.
3) Import HermeticWiper Malware_event-handler.json or HermeticWiper Malware_event-handler.json event handler: - Choose an ADOM (if ADOMs are enabled). The ADOM may be of type Fabric or FortiGate:
- Choose the FortiSOC module. - Select Event Handler List. - Select the Import option under More. - Select the appropriate event handler depending on the ADOM type.
Result:
The event handler is enabled and will be triggered if the appropriate logs are received following the import of the event handler. Edit the event handler to customize the notification section.
4) Import HermeticWiper Malware_report.dat or HermeticWiper Malware_report.dat to Reports:
- Choose an ADOM (if ADOMs are enabled). ADOM may be of type Fabric or FortiGate. - Select the appropriate file for the ADOM type to add the report to the ADOM.
Result: The HermeticWiper Malware_report can be run anytime as determined by an admin user. |
