Real-time monitoring identifies a process performing rapid, bulk deletion or overwrite of files across multiple Industrial Control System (ICS)-relevant directories within a short time window, by a process not associated with documented data retention management, correlated with a system crash shortly after. Documented in CaddyWiper, deployed via GPO alongside Industroyer2. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | gpo:deployment | destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously |
| File Deletion (DC0040) | WinEventLog:Sysmon | EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools |
| Process Creation (DC0032) | WinEventLog:System | System crash or unexpected halt occurring within wiper crash window of the bulk deletion event |
| Field | Description |
|---|---|
| AuthorizedDataManagementTools | Allowlist of backup/archival/retention management tools authorized to perform bulk file operations. |
| BulkDeletionThreshold | File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup. |
| DataDestructionTimeWindow | Time window over which bulk deletion activity is measured. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue memory erase commands. |
| WiperCrashWindow | Time window after bulk deletion within which a system crash is considered part of the same destructive event. |
Real-time monitoring identifies rapid, bulk deletion of files across Industrial Control System (ICS) data directories on a Linux asset, by a User Identifier (UID) not associated with documented data retention management, correlated with worm-based propagation indicators consistent with documented Linux wiper malware (Awfulshred, SoloShred). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| File Deletion (DC0040) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: rm/shred/dd operations across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold, by User Identifier (UID) not in authorized data management UIDs |
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Secure Shell (SSH)-based propagation pattern (connection to multiple hosts followed by file transfer and execution) within a short window |
| Field | Description |
|---|---|
| AuthorizedDataManagementTools | Allowlist of backup/archival/retention management tools authorized to perform bulk file operations. |
| BulkDeletionThreshold | File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup. |
| DataDestructionTimeWindow | Time window over which bulk deletion activity is measured. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue memory erase commands. |
| WiperCrashWindow | Time window after bulk deletion within which a system crash is considered part of the same destructive event. |
Real-time monitoring identifies an Industrial Control System (ICS) network device receiving a configuration erase command from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or outside a change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | networkdevice:syslog | write erase or factory-reset command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| AuthorizedDataManagementTools | Allowlist of backup/archival/retention management tools authorized to perform bulk file operations. |
| BulkDeletionThreshold | File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup. |
| DataDestructionTimeWindow | Time window over which bulk deletion activity is measured. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue memory erase commands. |
| WiperCrashWindow | Time window after bulk deletion within which a system crash is considered part of the same destructive event. |
Real-time monitoring identifies an Industrial Control System (ICS) protocol command sequence that erases device memory, from a source not in the approved engineering workstation list, where the device subsequently becomes unresponsive or requires re-commissioning. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | Initialize_Memory or MEMORY_RESET service from source not in engineering workstation list |
| Field | Description |
|---|---|
| AuthorizedDataManagementTools | Allowlist of backup/archival/retention management tools authorized to perform bulk file operations. |
| BulkDeletionThreshold | File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup. |
| DataDestructionTimeWindow | Time window over which bulk deletion activity is measured. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue memory erase commands. |
| WiperCrashWindow | Time window after bulk deletion within which a system crash is considered part of the same destructive event. |