Essential information

Value / Name

7e5af65d8d248d5bfa71e828a7186cd1cdd0cea3

Confidence

100/100

Revoked

Yes

Valid from

09/11/2023 15:13

Valid until

11/02/2025 15:13

Pattern type

yara

Published

20/12/2025 19:41

Modified

21/12/2025 01:49

Author / Source

AlienVault

Description

Pattern

rule M_Hunting_MicroSCADA_SCILC_Program_Execution_Strings   
   {   
     meta:   
        author = "Mandiant"   
        date = "2023-02-13"   
        description = "Searching for files containing strings associated with execution of the MicroSCADA Supervisory Control Implementation Language (SCIL) scilc.exe binary."   
        disclaimer = "This rule is for hunting purposes only and has not been tested to run in a production environment."   
      strings:   
        $s = "scilc.exe -do" nocase ascii wide   
      condition:   
        filesize < 1MB and   
        all of them   
   }

Labels / Tags

Labels: caddywiper gogetter microscada partyticket powershell russia sandworm scil ukraine variant wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.