Windows Process Command-Line Indicators of BlackByte Ransomware Activity

title: Windows Process Command-Line Indicators of BlackByte Ransomware Activity
id: 70f0b5b2-b843-45f1-80d1-026de773e7b6
status: test
description: This rule flags Windows process creation events where the command line matches specific patterns associated with BlackByte ransomware behavior, including command-line options and script-based actions. Such activity matters because it can indicate attempts to execute malicious commands, disable or remove components, and launch decoy or helper processes. The detection relies on telemetry from Windows process creation, specifically the Image path prefix and CommandLine substrings.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2023-02-08
tags:
  - attack.execution
  - attack.impact
  - attack.stealth
  - attack.t1485
  - attack.t1498
  - attack.t1059.001
  - attack.t1140
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    Image|startswith: C:\Users\Public\
    CommandLine|contains: " -single "
  selection_2:
    CommandLine|contains:
      - del C:\Windows\System32\Taskmgr.exe
      - ;Set-Service -StartupType Disabled $
      - powershell -command "$x =[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(
      - " do start wordpad.exe /p "
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 999e8307-a775-4d5f-addc-4855632335be
    type: derived