Lotus Wiper Destructive Activity & Orchestration Detection
This detection identifies activity associated with the Lotus Wiper destructive malware campaign, including its orchestration scripts, staging artifacts, and destructive behaviors. The detection focuses on: Execution of binaries and scripts from suspicious directories (e.g., C:\lotus\) Use of batch scripts such as OhSyncNow.bat and notesreg.bat Deployment of auxiliary binaries (nstats.exe, nevent.exe, ndesign.exe) System-level destructive actions including: Disk wiping via diskpart clean all File destruction using robocopy /MIR and fsutil file createnew Network disruption via netsh interface disable Account and security manipulation (e.g., disabling users, modifying CachedLogonsCount) Service tampering (e.g., UI0Detect stop/disable) This detection is behavior-based and designed to identify Lotus Wiper activity even when file names or paths are slightly modified.
Splunk (SPL)
