Essential information

Value / Name

692b505a3a5efb4b0b1f0a72e2d8dbebe2afb3d3

Confidence

100/100

Revoked

Yes

Valid from

09/11/2023 15:13

Valid until

11/02/2025 15:13

Pattern type

yara

Published

20/12/2025 19:41

Modified

21/12/2025 01:49

Author / Source

AlienVault

Description

Pattern

rule M_Methodology_MicroSCADA_SCILC_Strings   
   {   
     meta:   
        author = "Mandiant"   
        date = "2023-02-13"   
        description = "Searching for files containing strings associated with the MicroSCADA Supervisory Control Implementation Language (SCIL) scilc.exe binary."   
        disclaimer = "This rule is for hunting purposes only and has not been tested to run in a production environment."   
      strings:   
        $s1 = "scilc.exe" ascii wide   
        $s2 = "Scilc.exe" ascii wide   
        $s3 = "SCILC.exe" ascii wide   
        $s4 = "SCILC.EXE" ascii wide   
      condition:   
        filesize < 1MB and   
        any of them   
   }

Labels / Tags

Labels: caddywiper gogetter microscada partyticket powershell russia sandworm scil ukraine variant wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.