Handala Threat Advisory:
The Stryker Wiper Attack

title: Handala Wiper - Carroll Batch Script Execution
id: a7e3f0f0-hand-ala1-2026-stryker001
status: experimental
description: Detects execution pattern of Handala wiper batch script (Carroll → Carroll.cmd copy and execute)
references:
    - https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html
    - https://blog.talosintelligence.com/
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.execution
    - attack.t1059.003
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd_copy:
        CommandLine|contains|all:
            - 'copy'
            - 'Carroll'
            - '.cmd'
    selection_cmd_exec:
        CommandLine|contains:
            - 'Carroll.cmd'
    condition: selection_cmd_copy or selection_cmd_exec
falsepositives:
    - Unlikely in legitimate environments
level: critical

title: Handala Wiper - Antivirus Process Discovery
id: a7e3f0f0-hand-ala2-2026-stryker002
status: experimental
description: Detects batch script checking for multiple AV processes before payload staging (Handala evasion pattern)
references:
    - https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.discovery
    - attack.t1518.001
    - attack.defense_evasion
    - attack.t1497.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_tasklist:
        CommandLine|contains: 'tasklist'
    filter_av_names:
        CommandLine|contains:
            - 'wrsa.exe'
            - 'opssvc.exe'
            - 'avastui.exe'
            - 'avgui.exe'
            - 'bdservicehost.exe'
            - 'nswscsvc.exe'
            - 'sophoshealth.exe'
    condition: selection_tasklist and filter_av_names
falsepositives:
    - IT inventory scripts that enumerate running AV processes
level: high

title: Handala Wiper - BYOVD ListOpenedFileDrv Driver Loading
id: a7e3f0f0-hand-ala3-2026-stryker003
status: experimental
description: Detects loading of ListOpenedFileDrv driver used by Handala for kernel-level file enumeration before wiping
references:
    - https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.persistence
    - attack.t1543.003
logsource:
    category: driver_load
    product: windows
detection:
    selection_driver:
        ImageLoaded|endswith:
            - 'ListOpenedFileDrv_32.sys'
            - 'ListOpenedFileDrv.sys'
    selection_pdb:
        ImageLoaded|contains: 'openfilefinder'
    condition: selection_driver or selection_pdb
falsepositives:
    - Legitimate use of OpenFileFinder utility (rare)
level: critical

title: Handala Wiper - AutoIt Injection into Regasm.exe
id: a7e3f0f0-hand-ala4-2026-stryker004
status: experimental
description: Detects AutoIt-based shellcode injection into Regasm.exe process (Handala wiper delivery)
references:
    - https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.execution
    - attack.t1059.010
    - attack.defense_evasion
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection_autoit_parent:
        ParentImage|endswith: 'AutoIt3.exe'
    selection_regasm_child:
        Image|endswith: 'RegAsm.exe'
    condition: selection_autoit_parent and selection_regasm_child
falsepositives:
    - AutoIt scripts legitimately invoking .NET assembly registration (uncommon)
level: critical

title: Handala Wiper - Ping-Based Sleep Evasion
id: a7e3f0f0-hand-ala5-2026-stryker005
status: experimental
description: Detects use of ping -n with high count for time-based evasion (90-180 second delays)
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.defense_evasion
    - attack.t1497.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'ping -n'
    filter_high_count:
        CommandLine|re: 'ping\s+-n\s+(9[0-9]|1[0-8][0-9])\s+'
    condition: selection and filter_high_count
falsepositives:
    - Network testing scripts using long ping counts
level: medium

title: Handala Wiper - Telegram Bot API Communication
id: a7e3f0f0-hand-ala6-2026-stryker006
status: experimental
description: Detects outbound HTTP(S) connections to Telegram Bot API used as C2 by Handala wiper
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.exfiltration
    - attack.t1567.002
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: proxy
    product: network
detection:
    selection:
        url|contains:
            - 'api.telegram.org/bot'
        method: 'POST'
    condition: selection
falsepositives:
    - Legitimate Telegram bot integrations (correlate with process context)
level: high

title: Handala Wiper - NSIS Package Suspicious File Creation
id: a7e3f0f0-hand-ala7-2026-stryker007
status: experimental
description: Detects NSIS installer creating files without extensions in suspicious paths (Handala payload staging)
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.execution
    - attack.t1059
    - attack.defense_evasion
logsource:
    category: file_event
    product: windows
detection:
    selection_nsis:
        Image|endswith:
            - '\makensis.exe'
            - '\nsis.exe'
    selection_suspicious_path:
        TargetFilename|contains:
            - '\windows\temp\'
            - '\users\public\'
            - '\AppData\Local\Temp\'
            - '\564784\'
    filter_no_extension:
        TargetFilename|re: '\\[^.\\]+$'
    condition: (selection_nsis or selection_suspicious_path) and filter_no_extension
falsepositives:
    - Legitimate NSIS installers (rare to create no-extension files)
level: high

title: Handala Wiper - Mass File Overwrite Detection
id: a7e3f0f0-hand-ala8-2026-stryker008
status: experimental
description: Detects rapid file modification pattern consistent with wiper behavior (mass 4096-byte overwrites)
author: HAWK-EYE Threat Intelligence
date: 2026/03/11
tags:
    - attack.impact
    - attack.t1485
    - attack.t1561.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventType: 'FileModified'
    timeframe: 60s
    condition: selection | count() by Image > 100
falsepositives:
    - Disk encryption tools, legitimate bulk file operations
level: critical

rule Handala_Wiper_Carroll_Batch {
    meta:
        description = "Detects Handala wiper obfuscated batch script (Carroll)"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        reference = "https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html"
        tlp = "TLP:CLEAR"
        severity = "CRITICAL"
    
    strings:
        $cmd_copy = "cmd /k copy" ascii nocase
        $carroll = "Carroll" ascii
        $cmd_ext = ".cmd" ascii
        $exit = "& exit" ascii
        
        // AV process checks
        $av1 = "wrsa.exe" ascii nocase
        $av2 = "opssvc.exe" ascii nocase
        $av3 = "avastui.exe" ascii nocase
        $av4 = "avgui.exe" ascii nocase
        $av5 = "bdservicehost.exe" ascii nocase
        $av6 = "nswscsvc.exe" ascii nocase
        $av7 = "sophoshealth.exe" ascii nocase
        
        // Time delay evasion
        $ping_delay = "ping -n" ascii nocase
    
    condition:
        filesize < 500KB and
        (($cmd_copy and $carroll and $cmd_ext) or
         (3 of ($av*) and $ping_delay))
}

rule Handala_Wiper_AutoIt_Loader {
    meta:
        description = "Detects Handala AutoIt-based wiper payload loader"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "CRITICAL"
    
    strings:
        $autoit_header = "#AutoIt3Wrapper" ascii
        $rtl_decompress = "RtlDecompressFragment" ascii wide
        $shellcode_x86 = { 55 8B EC 83 EC ?? 53 56 57 }
        $shellcode_x64 = { 48 89 5C 24 ?? 48 89 74 24 ?? 57 48 83 EC }
        $regasm = "RegAsm" ascii wide nocase
        $inject_api = "NtWriteVirtualMemory" ascii wide
        $create_proc = "CreateProcessA" ascii wide
    
    condition:
        filesize < 5MB and
        ($autoit_header or $rtl_decompress) and
        ($regasm or $inject_api or $create_proc) and
        any of ($shellcode_*)
}

rule Handala_Wiper_Disk_Overwrite {
    meta:
        description = "Detects Handala wiper disk overwrite component"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "CRITICAL"
    
    strings:
        // File overwrite patterns
        $overwrite_func = { 8B ?? ?? 83 ?? 00 10 00 00 }  // 4096 byte check
        $random_fill = "RtlGenRandom" ascii wide
        $zero_fill = { C7 ?? 00 00 00 00 C7 ?? 04 00 00 00 00 }
        
        // System info gathering (pre-wipe recon)
        $hostname = "COMPUTERNAME" ascii wide
        $username = "USERNAME" ascii wide
        $domain = "USERDOMAIN" ascii wide
        $diskspace = "GetDiskFreeSpaceEx" ascii wide
        
        // Telegram C2
        $telegram = "api.telegram.org" ascii wide
        $bot_token = "/bot" ascii wide
        $send_msg = "sendMessage" ascii wide
        $send_doc = "sendDocument" ascii wide
        
        // IP check
        $ip_check = "icanhazip.com" ascii wide
    
    condition:
        filesize < 10MB and
        (2 of ($overwrite_func, $random_fill, $zero_fill)) and
        (2 of ($hostname, $username, $domain, $diskspace)) and
        ($telegram or $ip_check)
}

rule Handala_BYOVD_ListOpenedFileDrv {
    meta:
        description = "Detects BYOVD driver used by Handala for kernel file enumeration"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "HIGH"
    
    strings:
        $pdb = "openfilefinder_src" ascii nocase
        $driver_name = "ListOpenedFileDrv" ascii wide nocase
        $device_io = "DeviceIoControl" ascii wide
        $file_object = "FILE_OBJECT" ascii wide
    
    condition:
        uint16(0) == 0x5A4D and
        filesize < 100KB and
        ($pdb or $driver_name) and
        ($device_io or $file_object)
}

rule Handala_NSIS_NoExtension_Payload {
    meta:
        description = "Detects NSIS installer with no-extension payload files (Handala delivery)"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        severity = "HIGH"
    
    strings:
        $nsis_header = { EF BE AD DE 4E 75 6C 6C }  // NSIS magic
        $nsis_str = "Nullsoft" ascii
        $cmd_copy_pattern = "cmd /k copy" ascii nocase
        $autoit_ref = "AutoIt" ascii nocase
        $concat_pattern = /copy\s+\/b\s+\w+\+\w+/ ascii nocase
    
    condition:
        ($nsis_header or $nsis_str) and
        ($cmd_copy_pattern or $autoit_ref or $concat_pattern)
}

rule Handala_BiBi_Wiper_Family {
    meta:
        description = "Detects BiBi wiper variants associated with Handala/Void Manticore"
        author = "HAWK-EYE Threat Intelligence"
        date = "2026-03-11"
        reference = "Check Point Research - Void Manticore"
        severity = "CRITICAL"
    
    strings:
        $bibi_str1 = "BiBi" ascii wide nocase
        $bibi_str2 = "[+] Stats:" ascii
        $wiper_msg = "You have been pwned" ascii wide nocase
        $ext_target = ".pdf" ascii
        $ext_target2 = ".docx" ascii
        $ext_target3 = ".xlsx" ascii
        
        // Disk operations
        $raw_disk = "\\\\.\\PhysicalDrive" ascii wide
        $partition = "\\\\.\\PHYSICALDRIVE" ascii wide
        $mbr_access = { B8 00 00 00 00 BA 00 00 00 00 }
    
    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        (($bibi_str1 or $bibi_str2 or $wiper_msg) and
         ($raw_disk or $partition or $mbr_access))
}