Russian State-Sponsored Attack on Jaguar Land Rover: Defending Against Novel Encryption Wipers

---
title: Potential Mass File Encryption via Renaming
id: 8a2c4e9d-1f3a-4b5a-9c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential wiper or ransomware activity by identifying processes that rename a high volume of files in a short period, a common characteristic of encryption-based attacks.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_rename
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '.encrypted'
      - '.locked'
      - '.wiped'
  condition: selection | count(TargetFilename) by Image > 50
falsepositives:
  - Legitimate bulk backup operations
  - System maintenance scripts
level: high
---
title: Clearing Windows Event Logs to Obfuscate Attribution
id: 9b3d5f0e-2g4b-5c6d-0d1e-8f9a0b1c2d3e
status: experimental
description: Detects attempts to clear Windows Event Logs, a technique frequently used by destructive threats and APT groups to hinder incident response and attribution efforts.
references:
  - https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\wevtutil.exe'
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - 'cl '               # 'cl' is the flag for clear log in wevtutil
      - 'Clear-EventLog'
      - 'Remove-EventLog'
  condition: all of selection_*
falsepositives:
  - Administrative log maintenance
level: critical
---
title: Suspicious Service Stop on Critical Backup Services
id: 0c4e5f6a-1h2i-3j4k-5l6m-7n8o9p0q1r2s
status: experimental
description: Detects the stopping of services related to backup or security software, which is often a precursor to destructive encryption attacks to prevent data recovery.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - 'stop '
      - 'Stop-Service'
  selection_targets:
    CommandLine|contains:
      - 'VSS'
      - 'SQLAgent'
      - 'backup'
      - 'sophos'
      - 'crowdstrike'
      - 'defender'
  condition: all of selection_*
falsepositives:
  - Legitimate service restarts by IT staff
level: high

// Hunt for processes modifying large volumes of files (Potential Wiper)
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize Count = count(), FileSet = makeset(FileName) by InitiatingProcessFileName, InitiatingProcessAccountName, DeviceName
| where Count > 100
| order by Count desc
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, Count, FileSet

-- Hunt for log clearing and process masquerading
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username
FROM pslist()
WHERE Name = "wevtutil.exe" 
   OR Name =~ "svchost.exe" 
   AND Exe NOT IN ("C:\\Windows\\System32\\svchost.exe", "C:\\Windows\\SysWOW64\\svchost.exe")

# Audit Critical Services and Hunt for Mass File Changes
Write-Host "[+] Starting Audit for Destructive Threat Indicators..." -ForegroundColor Cyan

# 1. Check Status of VSS and Backup Services
$services = @("VSS", "SQLWriter", "SqlAgent$")
Write-Host "[+] Checking Critical Backup Services..."
foreach ($s in $services) {
    $svc = Get-Service -Name $s -ErrorAction SilentlyContinue
    if ($svc) {
        if ($svc.Status -ne "Running") {
            Write-Host "[!] ALERT: Service $s is currently $($svc.Status)" -ForegroundColor Red
        } else {
            Write-Host "[OK] Service $s is Running" -ForegroundColor Green
        }
    }
}

# 2. Hunt for files with suspicious extensions modified in the last 24h
$paths = @("C:\Users\", "C:\\ProgramData")
$extensions = @("*.encrypted", "*.locked", "*.wiped", "*.jlr")
Write-Host "[+] Scanning for suspicious file extensions..."

$found = $false
foreach ($p in $paths) {
    if (Test-Path $p) {
        foreach ($ext in $extensions) {
            $files = Get-ChildItem -Path $p -Filter $ext -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
            if ($files) {
                $found = $true
                Write-Host "[!] FOUND: $($files.Count) files matching $ext in $p" -ForegroundColor Red
                $files | Select-Object FullName, LastWriteTime | Format-Table -AutoSize
            }
        }
    }
}

if (-not $found) {
    Write-Host "[OK] No suspicious bulk file modifications found." -ForegroundColor Green
}