splunk-security_content/docs/_stories/double_zero_destructor.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Double Zero Destructor	2022-03-25	true		Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Exploitation

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2022-03-25
• Author: Teoderick Contreras, Rod Soto, Splunk
• ID: f56e8c00-3224-4955-9a6e-924ec7da1df7

Narrative

Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls.

Detections

Name	Technique	Type
Executables Or Script Creation In Suspicious Path	Masquerading	TTP
Suspicious Process File Path	Create or Modify System Process	TTP
Windows Deleted Registry By A Non Critical Process File Path	Modify Registry	Anomaly
Windows Terminating Lsass Process	Disable or Modify Tools, Impair Defenses	Anomaly

Reference

• https://cert.gov.ua/article/38088
• https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html

source | version: 1