Windows: Command-Line Indicators of BlackByte Ransomware Activity

title: "Windows: Command-Line Indicators of BlackByte Ransomware Activity"
id: 70f0b5b2-b843-45f1-80d1-026de773e7b6
status: test
description: This rule matches Windows process creation command-line patterns associated with BlackByte ransomware activity, including public-directory execution markers and specific destructive and scripting-related command fragments. Attackers may use these commands to prepare impact actions, disable recovery persistence, and run encoded PowerShell payloads. Telemetry relies on process creation events with captured Image paths and CommandLine content to identify these targeted substrings.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2023-02-08
tags:
  - attack.execution
  - attack.impact
  - attack.stealth
  - attack.t1485
  - attack.t1498
  - attack.t1059.001
  - attack.t1140
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    Image|startswith: C:\Users\Public\
    CommandLine|contains: " -single "
  selection_2:
    CommandLine|contains:
      - del C:\Windows\System32\Taskmgr.exe
      - ;Set-Service -StartupType Disabled $
      - powershell -command "$x =[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(
      - " do start wordpad.exe /p "
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 999e8307-a775-4d5f-addc-4855632335be
    type: derived