---
title: Potential CanisterWorm Locale Check and Wiper Activity
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious process activity where system locale or timezone is queried immediately followed by destructive file commands. TTP associated with CanisterWorm.
references:
  - https://krebsonsecurity.com/2026/03/canisterworm-springs-wiper-attack-targeting-iran/
author: Security Arsenal
date: 2026/03/27
tags:
  - attack.execution
  - attack.t1059.001
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_locale:
    CommandLine|contains:
      - 'Get-TimeZone'
      - 'Get-Culture'
      - 'Get-WinSystemLocale'
      - 'tzutil /g'
  selection_wiper:
    CommandLine|contains:
      - 'Remove-Item'
      - 'Format-Volume'
      - 'cipher /w'
      - 'del /f /s /q'
  filter_timespan:
    # This logic implies proximity in execution, simplified here for detection rule logic
    # In practice, correlation via SIEM is preferred, but this hunts for co-occurrence in short logs
    CommandLine|contains: 'canister' # Placeholder if specific artifact name known, else rely on sequence
  condition: 1 of selection_* and not filter_legit
falsepositives:
  - Legitimate system administration scripts that check time before maintenance
level: high
---
title: Linux Locale Check Followed By Data Destruction
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential Linux wiper behavior involving checking timezone/locale (Iran/Farsi) followed by destructive deletion commands.
references:
  - https://krebsonsecurity.com/2026/03/canisterworm-springs-wiper-attack-targeting-iran/
author: Security Arsenal
date: 2026/03/27
tags:
  - attack.execution
  - attack.t1059.004
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: linux
detection:
  selection_check:
    CommandLine|contains:
      - 'timedatectl'
      - 'cat /etc/timezone'
      - 'locale'
      - 'echo $LANG'
  selection_wipe:
    CommandLine|contains:
      - 'rm -rf'
      - 'shred'
      - 'dd if=/dev/zero'
      - ':()>/'
  condition: selection_check and selection_wipe
falsepositives:
  - System administration scripts involving cleanup based on location
level: high

// Hunt for processes checking locale/timezone followed by destructive commands
// Look for PowerShell scripts checking TimeZone settings
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine matches regex @"(Get-TimeZone|Get-Culture|tzutil)" 
   or ProcessCommandLine matches regex @"(Remove-Item|Format-Volume|del /f /s /q)"
| extend LocaleCheck = iff(ProcessCommandLine matches regex @"(Get-TimeZone|Get-Culture|tzutil)", "Check", "")
| extend WipeAction = iff(ProcessCommandLine matches regex @"(Remove-Item|Format-Volume|del /f /s /q)", "Wipe", "")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), CommandList=make_list(ProcessCommandLine) by DeviceName, AccountName, FolderPath
| where array_length(CommandList) > 1 
// Flag devices where both Check and Wipe logic appeared in process creation logs
| project DeviceName, AccountName, FirstSeen, LastSeen, CommandList

-- Hunt for suspicious process execution chains indicative of CanisterWorm
-- Targeting systems where locale check happens near destructive commands
SELECT 
  PID,
  Ppid,
  Name,
  CommandLine,
  Exe,
  Username,
  StartTime
FROM pslist()
WHERE 
  CommandLine =~ "Get-TimeZone" OR 
  CommandLine =~ "Get-Culture" OR 
  CommandLine =~ "tzutil" OR
  CommandLine =~ "Remove-Item" OR 
  CommandLine =~ "Format-Volume"
ORDER BY StartTime DESC

# CanisterWorm Remediation and Audit Script
# Checks for active suspicious processes and audits cloud security basics

Write-Host "Starting CanisterWorm Audit and Remediation..." -ForegroundColor Cyan

# 1. Hunt for Suspicious Processes (Locale Check + Wiper)
$suspiciousProcs = @(
    "Get-TimeZone", "Get-Culture", "tzutil", "Remove-Item", "Format-Volume", "cipher /w"
)

Write-Host "Checking for active processes matching wiper TTPs..." -ForegroundColor Yellow
Get-Process | Where-Object { 
    try {
        $proc = $_;
        $cmd = (Get-CimInstance Win32_Process -Filter "ProcessId = $($proc.Id)").CommandLine
        $suspiciousProcs | Where-Object { $cmd -match $_ }
    } catch { $false }
} | ForEach-Object {
    Write-Host "ALERT: Found suspicious process: $($_.ProcessName) (ID: $($_.Id))" -ForegroundColor Red
    # Note: Automated killing is risky, review output first
    # Stop-Process -Id $_.Id -Force -WhatIf
}

# 2. Audit for specific environment indicators (Passive Detection)
$currentZone = Get-TimeZone
$currentLang = Get-Culture | Select-Object -ExpandProperty Name

Write-Host "Current Time Zone: $($currentZone.Id)"
Write-Host "Current Locale: $currentLang"

if ($currentZone.Id -like "*Tehran*" -or $currentLang -like "fa*") {
    Write-Host "WARNING: System matches CanisterWorm targeting criteria (Iran/Farsi)." -ForegroundColor Red
    Write-Host "Recommendation: Isolate this host immediately if cloud-exposed." -ForegroundColor Red
}

# 3. Cloud Security Hardening Check (AWS/Azure CLI presence)
Write-Host "Auditing presence of Cloud CLI tools..." -ForegroundColor Yellow
$cloudTools = @("aws", "az", "gcloud")
foreach ($tool in $cloudTools) {
    if (Get-Command $tool -ErrorAction SilentlyContinue) {
        Write-Host "Found: $tool installed. Ensure credentials are rotated and MFA is enforced." -ForegroundColor Yellow
    }
}

Write-Host "Audit Complete." -ForegroundColor Green