Detection: Fsutil Zeroing File

Date: 2021-12-07 ID: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 Author: Michael Haag, Splunk Type: TTP Product: Splunk User Behavior Analytics

Description

This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host.

Annotations

No annotations available.

Implementation

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.

Known False Positives

System administrators or scripts may delete user accounts via this technique. Filter as needed.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message	Risk Score	Impact	Confidence
An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.	54	60	90

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Version: 4