splunk-security_content/docs/_posts/2021-08-11-fsutil_zeroing_file.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Fsutil Zeroing File	Indicator Removal on Host	Endpoint	2021-08-11	true		Indicator Removal on Host Defense Evasion Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint- Datasource: Splunk Add-on for Sysmon
• Last Updated: 2021-08-11
• Author: Teoderick Contreras, Splunk
• ID: 4e5e024e-fabb-11eb-8b8f-acde48001122

Annotations

ATT&CK

ID	Technique	Tactic
T1070	Indicator Removal on Host	Defense Evasion

Kill Chain Phase

• Exploitation

NIST

CIS20

CVE

Search

| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  Processes.process Processes.parent_process 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `fsutil_zeroing_file_filter`

Macros

The SPL above uses the following Macros:

• security_content_summariesonly
• security_content_ctime

Note that fsutil_zeroing_file_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required field

• _time
• Processes.user
• Processes.process_name
• Processes.parent_process_name
• Processes.dest
• Processes.process
• Processes.parent_process

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

unknown

Associated Analytic story

• Ransomware

RBA

Risk Score	Impact	Confidence	Message
54.0	60	90	Possible file data deletion on dest using process

Reference

• https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log

source | version: 1