Analytics Story: Double Zero Destructor

Date: 2022-03-25 ID: f56e8c00-3224-4955-9a6e-924ec7da1df7 Author: Teoderick Contreras, Rod Soto, Splunk Product: Splunk Enterprise Security

Description

Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.

Why it matters

Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Suspicious Process File Path	Create or Modify System Process	TTP
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Windows Deleted Registry By A Non Critical Process File Path	Modify Registry	Anomaly
Windows Suspicious Process File Path	Create or Modify System Process, Match Legitimate Name or Location	TTP
Windows Terminating Lsass Process	Disable or Modify Tools	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 10	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 12	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`xmlwineventlog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 1