splunk-security_content/stories/double_zero_destructor.yml

name: Double Zero Destructor
id: f56e8c00-3224-4955-9a6e-924ec7da1df7
version: 2
creation_date: '2022-03-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Rod Soto, Splunk
status: production
description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.
narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls.
references:
    - https://cert.gov.ua/article/38088
    - https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
category:
    - Data Destruction
    - Malware
    - Adversary Tactics
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
usecase: Advanced Threat Detection