Essential information

Value / Name

50c0bae4b9e827afb0e888c481fe3b091d7003f7

Confidence

100/100

Revoked

Yes

Valid from

09/11/2023 15:13

Valid until

11/02/2025 15:13

Pattern type

yara

Published

20/12/2025 19:41

Modified

21/12/2025 01:49

Author / Source

AlienVault

Description

Pattern

rule M_Methodology_MicroSCADA_Path_Strings   
   {   
     meta:   
        author = "Mandiant"   
        date = "2023-02-27"   
        description = "Searching for files containing references to MicroSCADA filesystem path containing native MicroSCADA binaries and resources."   
        disclaimer = "This rule is for hunting purposes only and has not been tested to run in a production environment."   
      strings:   
        $s1 = "sc\\prog\\exec" nocase ascii wide   
      condition:   
        filesize < 1MB and   
        $s1   
   }

Labels / Tags

Labels: caddywiper gogetter microscada partyticket powershell russia sandworm scil ukraine variant wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.