GigaWiper: Analysis and Defense Against Hybrid Wiper-Encryption Attacks

---
title: GigaWiper Suspicious Raw Disk Access
id: 9e8c7d6a-5b4e-4f3a-9c1b-8e7d6c5b4a3e
status: experimental
description: Detects processes attempting to open physical drives for write access, a common behavior for disk wiper malware like GigaWiper.
references:
  - https://attack.mitre.org/techniques/T1061/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1565.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '\\\\.\\PhysicalDrive'
      - '\\\\.\\HarddiskVolume'
    CommandLine|contains:
      - 'write'
      - 'lock'
  condition: selection
falsepositives:
  - Legitimate disk imaging tools (e.g., Ghost, Acronis)
  - Disk partitioning utilities
level: high
---
title: GigaWiper Multi-Pass Wiping Utility Usage
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the usage of built-in or third-party utilities utilized for multi-pass data wiping, often repurposed by wiper malware.
references:
  - https://attack.mitre.org/techniques/T1485/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_cipher:
    Image|endswith: '\\cipher.exe'
    CommandLine|contains: '/w'
  selection_sdelete:
    Image|endswith: '\\sdelete.exe'
    CommandLine|contains: '-p'
  condition: 1 of selection*
falsepositives:
  - Authorized administrative data sanitization
level: medium
---
title: GigaWiper Potential Encryption and Shutdown Sequence
id: f7e6d5c4-b3a2-4f1e-8d9c-0a1b2c3d4e5f
status: experimental
description: Detects suspicious patterns indicative of wiper malware involving rapid file encryption followed by system shutdown or reboot.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\shutdown.exe'
      - '\\rundll32.exe'
    CommandLine|contains:
      - '-r'
      - '-s'
  filter_legit:
    ParentImage|contains:
      - '\\services.exe'
      - '\\svchost.exe'
  timeframe: 1m
  condition: selection and not filter_legit
falsepositives:
  - Legitimate system restarts by IT staff
level: high


**KQL (Microsoft Sentinel)**

// Hunt for GigaWiper Indicators: Raw Disk Access and Wiping Tools
let SuspiciousProcesses = dynamic(['cipher.exe', 'sdelete.exe', 'vssadmin.exe']);
let RawDiskPattern = @"\\\\.\\(PhysicalDrive|HarddiskVolume)";
DeviceProcessEvents
| where Timestamp >= ago(1d)
// Detect raw disk access attempts
| where CommandLine matches regex RawDiskPattern or ProcessCommandLine has "format"
| union (
    DeviceProcessEvents
    | where FileName in~ SuspiciousProcesses
    | where CommandLine has_any ("/w", "-p", "delete shadows") // Wiping flags
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for GigaWiper: Processes interacting with physical devices or executing wiping commands
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ "\\\\.\\PhysicalDrive" 
   OR Name =~ "cipher.exe"
   OR Name =~ "sdelete.exe"
   OR CommandLine =~ "/w" 
   OR CommandLine =~ "-p"


**Remediation Script (PowerShell)**

# GigaWiper Hardening and Remediation Script
# Run with Administrative Privileges

# 1. Disable Unused Remote Services to limit initial access vectors
Write-Host "Hardening RDP and SMB configurations..."
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1
Set-SmbShare -Name "C$" -Force $false -ErrorAction SilentlyContinue

# 2. Audit and Protect VSS (Volume Shadow Copy Service) - often targeted by wipers
Write-Host "Checking VSS Service Status..."
$vssService = Get-Service -Name VSS
if ($vssService.Status -ne "Running") {
    Start-Service -Name VSS
    Set-Service -Name VSS -StartupType Automatic
}

# 3. Enable Windows Defender Real-time Monitoring (Critical for catching wiper behavior)
Write-Host "Ensuring Defender Real-time protection is active..."
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisableIOAVProtection $false -Force

# 4. Check for Suspicious Modifications to Boot Configuration (common with wipers)
Write-Host "Checking for suspicious BCD modifications..."
bcdedit /enum | Select-String -Pattern "path" | Out-Host

# 5. Audit for recent creation of scheduled tasks (persistence mechanism)
Write-Host "Auditing recent scheduled tasks..."
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-1)} | Select-Object TaskName, TaskPath, Author

Write-Host "Remediation and Hardening check complete."