Threat video1:00
LockBit 2.0 Reverse Engineering: Detection & IOCs
LockBit 2.0 encrypts only the first 4KB of each file and deploys domain-wide through SYSVOL; 15 IOCs and 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for LockBit 2.0 Reverse Engineering: Detection & IOCs →
Chapters
- 0:00The hook22 attack techniques deployed.
- 0:04The storyIt skips CIS-region locales.
- 0:10Attack pathHides strings, checks for debuggers.
- 0:23AttributionAttributed to LockBit.
- 0:27Indicators of compromise12 indicators to hunt: 1 SHA-256 hash, 1 MD5 hash and 4 file names, and more.
- 0:37MITRE ATT&CK techniques22 ATT&CK techniques, from execution to impact.
- 0:41Remediation4 steps now: Hunt for Restore-My-Files.txt, .lockbit files and LockBit_Ransomware.hta on endpoints.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0022 attack techniques deployed.
0:05It skips CIS-region locales.
0:07Spreads through Group Policy.
0:10Hides strings, checks for debuggers.
0:13Escalates via UAC bypass.
0:15Destroys backups and event logs.
0:17Encrypts files.
0:19Spreads laterally through Group Policy.
0:23Attributed to LockBit. Confidence: high.
0:2812 indicators to hunt: 1 SHA-256 hash, 1 MD5 hash and 4 file names, and more.
0:3722 ATT&CK techniques, from execution to impact.
0:424 steps now: Hunt for Restore-My-Files.txt, .lockbit files and LockBit_Ransomware.hta on endpoints.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.