huntrule

BlackByte ransomware registry modifications on Windows

Alerts on BlackByte-specific Windows registry value changes to DWORD 1 across three predefined keys.

FreeUnreviewedSigmahighv1
title: BlackByte ransomware registry modifications on Windows
id: 1d3ab098-9e82-4407-bb1f-5be8d4cb9bb9
status: test
description: This rule flags Windows registry writes that set specific values to DWORD 1 in three hard-coded keys associated with common post-compromise changes. Attackers may use these modifications to weaken access controls, permit additional connection behaviors, and adjust filesystem-related settings to support later actions such as persistence and movement. The detection relies on telemetry indicating registry_set events for the targeted registry paths and the written DWORD value.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/?utm_source=twitter&utm_medium=social
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/BlackByte/registry_set_win_malware_blackbyte_privesc_registry.yml
author: frack113, Huntrule Team
date: 2022-01-24
modified: 2025-10-21
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject:
      - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
      - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
      - HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\LongPathsEnabled
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 83314318-052a-4c90-a1ad-660ece38d276
    type: derived

What it detects

This rule flags Windows registry writes that set specific values to DWORD 1 in three hard-coded keys associated with common post-compromise changes. Attackers may use these modifications to weaken access controls, permit additional connection behaviors, and adjust filesystem-related settings to support later actions such as persistence and movement. The detection relies on telemetry indicating registry_set events for the targeted registry paths and the written DWORD value.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.