313 Team Threat Advisory:
The 313 Team Wiper Attack

# 313T-SIGMA-001 — DDoS Volumetric Attack — Government Portal
title: 313 Team DDoS Volumetric Attack Against Government Web Portal
status: experimental
description: Detects HTTP/HTTPS flood patterns consistent with 313 Team
  DDoS methodology targeting .gov.kw and regional government portals
logsource: 
  category: network 
  product: firewall
detection:
  selection:
    dst_port|in: [80, 443]
    dst_host|endswith:
      - '.gov.kw'
      - '.gov.jo'
      - '.mod.gov.kw'
  threshold:
    field: src_ip
    count: '>500'
    timespan: '60s'
  condition: selection and threshold
falsepositives: Legitimate traffic spikes during peak hours
level: high
tags: [313Team, Islamic_Cyber_Resistance, ddos, kuwait]

# 313T-SIGMA-002 — Web Application SQL Injection — HackBar Patterns
title: 313 Team HackBar SQL Injection Attempt
status: experimental
description: Detects SQL injection and XSS probing consistent with
  HackBar tooling used by Liwa Awli Aleazm development wing
logsource: 
  category: webserver 
  product: apache|nginx
detection:
  selection_sqli:
    cs-uri-query|contains:
      - "' OR '1'='1"
      - "UNION SELECT"
      - "1=1--"
      - "admin'--"
  selection_xss:
    cs-uri-query|contains:
      - '<script>'
      - 'javascript:'
      - 'onerror='
  condition: selection_sqli or selection_xss
falsepositives: Security scanners, penetration tests
level: medium
tags: [313Team, HackBar, sqli, xss, web_exploit]

# 313T-SIGMA-003 — Website Defacement — Government Portal Content Replace
title: 313 Team Coalition Branding Defacement Upload
status: experimental
description: Detects file uploads or webshell writes consistent with
  313 Team / Cyber Islamic Resistance defacement methodology
logsource: 
  category: file_event 
  product: windows|linux
detection:
  selection:
    TargetFilename|endswith:
      - 'index.html'
      - 'index.php'
      - 'default.aspx'
    EventType: 'FileCreate'
    User|not-contains: 'SYSTEM'
  web_root:
    TargetFilename|contains:
      - '/var/www/'
      - '/inetpub/wwwroot/'
      - 'htdocs'
  condition: selection and web_root
falsepositives: Legitimate web deployments
level: high
tags: [313Team, defacement, web_compromise, CIR]

# 313T-SIGMA-004 — Telegram C2 / Coalition Coordination Beacon
title: 313 Team Telegram Infrastructure Communication
status: experimental
description: Detects outbound HTTP connections to Telegram API endpoints
  consistent with 313 Team attack coordination and C2 patterns
logsource: 
  category: proxy 
  product: proxy
detection:
  selection:
    cs-host|endswith: 'api.telegram.org'
    cs-method: 'POST'
    cs-uri-path|contains: '/bot'
  internal_src:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and internal_src
falsepositives: Legitimate Telegram bots, notification services
level: medium
tags: [313Team, telegram, c2, coordination]

# 313T-SIGMA-005 — Check-Host Uptime Verification Beacon
title: 313 Team Check-Host Attack Validation Pattern
status: experimental
description: Detects outbound connections to check-host.net or similar
  uptime monitoring services used by 313 Team to validate DDoS impact
  and generate proof screenshots for Telegram claim posting
logsource: 
  category: proxy 
  product: proxy
detection:
  selection:
    cs-host|endswith:
      - 'check-host.net'
      - 'isitdownrightnow.com'
      - 'downdetector.com'
  query_gov:
    cs-uri-query|contains:
      - '.gov.kw'
      - 'mod.gov.kw'
      - 'kuwaitarmy'
      - '.gov.jo'
  condition: selection and query_gov
falsepositives: Low — government IT staff performing availability checks
level: medium
tags: [313Team, ddos_validation, check_host, proof_collection]

# 313T-SIGMA-006 — CCTV / Surveillance System Unauthorized Access
title: Suspicious CCTV DVR/NVR Authentication — 313 Team TTPs
status: experimental
description: Detects brute force or default credential authentication
  attempts against DVR/NVR systems consistent with 313 Team claimed
  surveillance access in Bahrain government facilities
logsource: 
  category: network 
  product: ids
detection:
  selection:
    dst_port|in: [554, 8080, 8081, 37777, 34567, 9000]
  brute:
    EventType: 'auth_failure'
    count: '>5'
    timespan: '60s'
  known_cctv_ua:
    http.user_agent|contains:
      - 'Dahua'
      - 'Hikvision'
      - 'RTSP'
  condition: (selection and brute) or (selection and known_cctv_ua)
falsepositives: Legitimate CCTV management activity
level: medium
tags: [313Team, cctv, surveillance, initial_access, IoT]

# 313T-SIGMA-007 — HTTP Flood Signature — Multi-Source Same Target
title: Multi-Source HTTP Flood Consistent with 313 Team DDoS
status: experimental
description: Detects distributed HTTP flood from multiple source IPs
  targeting same government web endpoint — characteristic of 313 Team
  coalition-pooled DDoS infrastructure methodology
logsource: 
  category: network 
  product: waf
detection:
  selection:
    http.method: 'GET'
    http.status: ['200', '503', '504']
  concentration:
    dst_host: same_value
    src_ip: 
      unique_count: '>50'
    timespan: '30s'
    request_rate: '>1000/s'
  condition: selection and concentration
falsepositives: Legitimate high-traffic events, CDN origin pulls
level: high
tags: [313Team, ddos, http_flood, botnet, coalition]

# 313T-SIGMA-008 — ICS/OT Protocol Anomaly — Government Utility Network
title: Suspicious ICS Protocol Access — 313 Team ICS Claim TTPs
status: experimental
description: Detects anomalous access to industrial control protocols
  in government networks consistent with claimed 313 Team / CIR ICS
  access targeting Gulf government utility and defense infrastructure
logsource: 
  category: network 
  product: ids
detection:
  selection:
    dst_port|in: [502, 102, 20000, 44818, 47808, 1911, 4840]
    EventType: 'new_connection'
  not_expected:
    src_ip|not-cidr:
      - '192.168.100.0/24'
      - '10.10.10.0/24'
  condition: selection and not_expected
falsepositives: Authorized ICS vendor access, patch windows
level: critical
tags: [313Team, ICS, OT, modbus, S7, dnp3, critical_infra]

# 313T-SIGMA-009 — Coordinated Defacement Branding Keywords
title: 313 Team / Cyber Islamic Resistance Defacement Content Detection
status: experimental
description: Detects web application response content containing
  313 Team or Islamic Cyber Resistance coalition branding keywords
  inserted during defacement operations
logsource: 
  category: webserver 
  product: apache|nginx|iis
detection:
  selection:
    cs-uri-stem|endswith:
      - '/index.html'
      - '/index.php'
      - '/'
  branding_keywords:
    response_body|contains:
      - '313 Team'
      - 'Islamic Cyber Resistance'
      - 'Electronic Operations Room'
      - 'Al-Imamah313'
      - 'Liwa Awli Aleazm'
  condition: selection and branding_keywords
falsepositives: Near-zero — keywords unique to this group
level: critical
tags: [313Team, defacement, branding, IOC, web_compromise]

# 313T-SIGMA-010 — Coalition Target List Domain Reconnaissance
title: 313 Team Pre-Attack Government Portal Reconnaissance
status: experimental
description: Detects DNS resolution or HTTP probing of known 313 Team
  declared target domains from non-government source IPs, consistent
  with pre-attack reconnaissance pattern
logsource: 
  category: dns 
  product: dns
detection:
  selection:
    dns.query.name|in:
      - 'kuwaitarmy.gov.kw'
      - 'mod.gov.kw'
      - 'knguard.gov.kw'
      - 'moe.gov.kw'
      - 'e.gov.kw'
      - 'cait.gov.kw'
      - 'moh.gov.kw'
  suspicious_src:
    src_ip|not-cidr:
      - '10.0.0.0/8'
      - '46.x.x.x'
  query_rate:
    count: '>10'
    timespan: '60s'
  condition: selection and suspicious_src
falsepositives: Search engines, CDN health checks
level: medium
tags: [313Team, recon, dns, kuwait_gov, pre_attack]

rule 313 Team_Wiper_Carroll_Batch {
    meta:
        description = "Detects 313 Team wiper obfuscated batch script (Carroll)"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        reference = "https://www.splunk.com/en_us/blog/security/313 Teams-wiper-threat-analysis-and-detections.html"
        tlp = "TLP:CLEAR"
        severity = "CRITICAL"
    
    strings:
        $cmd_copy = "cmd /k copy" ascii nocase
        $carroll = "Carroll" ascii
        $cmd_ext = ".cmd" ascii
        $exit = "& exit" ascii
        
        // AV process checks
        $av1 = "wrsa.exe" ascii nocase
        $av2 = "opssvc.exe" ascii nocase
        $av3 = "avastui.exe" ascii nocase
        $av4 = "avgui.exe" ascii nocase
        $av5 = "bdservicehost.exe" ascii nocase
        $av6 = "nswscsvc.exe" ascii nocase
        $av7 = "sophoshealth.exe" ascii nocase
        
        // Time delay evasion
        $ping_delay = "ping -n" ascii nocase
    
    condition:
        filesize < 500KB and
        (($cmd_copy and $carroll and $cmd_ext) or
         (3 of ($av*) and $ping_delay))
}

rule 313 Team_Wiper_AutoIt_Loader {
    meta:
        description = "Detects 313 Team AutoIt-based wiper payload loader"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "CRITICAL"
    
    strings:
        $autoit_header = "#AutoIt3Wrapper" ascii
        $rtl_decompress = "RtlDecompressFragment" ascii wide
        $shellcode_x86 = { 55 8B EC 83 EC ?? 53 56 57 }
        $shellcode_x64 = { 48 89 5C 24 ?? 48 89 74 24 ?? 57 48 83 EC }
        $regasm = "RegAsm" ascii wide nocase
        $inject_api = "NtWriteVirtualMemory" ascii wide
        $create_proc = "CreateProcessA" ascii wide
    
    condition:
        filesize < 5MB and
        ($autoit_header or $rtl_decompress) and
        ($regasm or $inject_api or $create_proc) and
        any of ($shellcode_*)
}

rule 313 Team_Wiper_Disk_Overwrite {
    meta:
        description = "Detects 313 Team wiper disk overwrite component"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "CRITICAL"
    
    strings:
        // File overwrite patterns
        $overwrite_func = { 8B ?? ?? 83 ?? 00 10 00 00 }  // 4096 byte check
        $random_fill = "RtlGenRandom" ascii wide
        $zero_fill = { C7 ?? 00 00 00 00 C7 ?? 04 00 00 00 00 }
        
        // System info gathering (pre-wipe recon)
        $hostname = "COMPUTERNAME" ascii wide
        $username = "USERNAME" ascii wide
        $domain = "USERDOMAIN" ascii wide
        $diskspace = "GetDiskFreeSpaceEx" ascii wide
        
        // Telegram C2
        $telegram = "api.telegram.org" ascii wide
        $bot_token = "/bot" ascii wide
        $send_msg = "sendMessage" ascii wide
        $send_doc = "sendDocument" ascii wide
        
        // IP check
        $ip_check = "icanhazip.com" ascii wide
    
    condition:
        filesize < 10MB and
        (2 of ($overwrite_func, $random_fill, $zero_fill)) and
        (2 of ($hostname, $username, $domain, $diskspace)) and
        ($telegram or $ip_check)
}

rule 313 Team_BYOVD_ListOpenedFileDrv {
    meta:
        description = "Detects BYOVD driver used by 313 Team for kernel file enumeration"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "HIGH"
    
    strings:
        $pdb = "openfilefinder_src" ascii nocase
        $driver_name = "ListOpenedFileDrv" ascii wide nocase
        $device_io = "DeviceIoControl" ascii wide
        $file_object = "FILE_OBJECT" ascii wide
    
    condition:
        uint16(0) == 0x5A4D and
        filesize < 100KB and
        ($pdb or $driver_name) and
        ($device_io or $file_object)
}

rule 313 Team_NSIS_NoExtension_Payload {
    meta:
        description = "Detects NSIS installer with no-extension payload files (313 Team delivery)"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "HIGH"
    
    strings:
        $nsis_header = { EF BE AD DE 4E 75 6C 6C }  // NSIS magic
        $nsis_str = "Nullsoft" ascii
        $cmd_copy_pattern = "cmd /k copy" ascii nocase
        $autoit_ref = "AutoIt" ascii nocase
        $concat_pattern = /copy\s+\/b\s+\w+\+\w+/ ascii nocase
    
    condition:
        ($nsis_header or $nsis_str) and
        ($cmd_copy_pattern or $autoit_ref or $concat_pattern)
}

rule 313 Team_BiBi_Wiper_Family {
    meta:
        description = "Detects BiBi wiper variants associated with 313 Team/Void Manticore"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        reference = "Check Point Research - Void Manticore"
        severity = "CRITICAL"
    
    strings:
        $bibi_str1 = "BiBi" ascii wide nocase
        $bibi_str2 = "[+] Stats:" ascii
        $wiper_msg = "You have been pwned" ascii wide nocase
        $ext_target = ".pdf" ascii
        $ext_target2 = ".docx" ascii
        $ext_target3 = ".xlsx" ascii
        
        // Disk operations
        $raw_disk = "\\\\.\\PhysicalDrive" ascii wide
        $partition = "\\\\.\\PHYSICALDRIVE" ascii wide
        $mbr_access = { B8 00 00 00 00 BA 00 00 00 00 }
    
    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        (($bibi_str1 or $bibi_str2 or $wiper_msg) and
         ($raw_disk or $partition or $mbr_access))
}