Windows Process Command-Line Indicators of BlackByte Ransomware Activity
Flags Windows process creation command-line patterns consistent with BlackByte ransomware techniques.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Execution → ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows process creation events where the command line matches specific patterns associated with BlackByte ransomware behavior, including command-line options and script-based actions. Such activity matters because it can indicate attempts to execute malicious commands, disable or remove components, and launch decoy or helper processes. The detection relies on telemetry from Windows process creation, specifically the Image path prefix and CommandLine substrings.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Command-Line Indicators of BlackByte Ransomware Activity
id: 70f0b5b2-b843-45f1-80d1-026de773e7b6
status: test
description: This rule flags Windows process creation events where the command line matches specific patterns associated with BlackByte ransomware behavior, including command-line options and script-based actions. Such activity matters because it can indicate attempts to execute malicious commands, disable or remove components, and launch decoy or helper processes. The detection relies on telemetry from Windows process creation, specifically the Image path prefix and CommandLine substrings.
references:
- https://redcanary.com/blog/blackbyte-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2023-02-08
tags:
- attack.execution
- attack.impact
- attack.stealth
- attack.t1485
- attack.t1498
- attack.t1059.001
- attack.t1140
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_1:
Image|startswith: C:\Users\Public\
CommandLine|contains: " -single "
selection_2:
CommandLine|contains:
- del C:\Windows\System32\Taskmgr.exe
- ;Set-Service -StartupType Disabled $
- powershell -command "$x =[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(
- " do start wordpad.exe /p "
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 999e8307-a775-4d5f-addc-4855632335be
type: derived