Try in Splunk Security Cloud
Description
Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackByte ransomware, including looking for file writes associated with BlackByte, persistence, initial access, account registry modification and more.
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Datamodel: Endpoint, Network_Traffic, Risk, Web
- Last Updated: 2023-07-10
- Author: Teoderick Contreras, Splunk
- ID: b18259ac-0746-45d7-bd1f-81d65274a80b
Narrative
BlackByte ransomware campaigns targeting business operations, involve the use of ransomware payloads, infection chain to collect and exfiltrate data and drop payload on the targeted system. BlackByte Ransomware operates by infiltrating a system through various methods, such as malicious email attachments, exploit kits, or compromised websites. Once inside a system, it begins encrypting files using strong encryption algorithms, rendering them unusable. After completing the encryption process, BlackByte Ransomware typically leaves a ransom note that explains the situation to the victim and provides instructions on how to pay the ransom to obtain the decryption key.
Detections
Name |
Technique |
Type |
Allow File And Printing Sharing In Firewall |
Disable or Modify Cloud Firewall, Impair Defenses |
TTP |
Allow Network Discovery In Firewall |
Disable or Modify Cloud Firewall, Impair Defenses |
TTP |
Anomalous usage of 7zip |
Archive via Utility, Archive Collected Data |
Anomaly |
CMD Echo Pipe - Escalation |
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process |
TTP |
Cobalt Strike Named Pipes |
Process Injection |
TTP |
DLLHost with no Command Line Arguments with Network |
Process Injection |
TTP |
Detect Exchange Web Shell |
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services |
TTP |
Detect PsExec With accepteula Flag |
Remote Services, SMB/Windows Admin Shares |
TTP |
Detect Regsvr32 Application Control Bypass |
System Binary Proxy Execution, Regsvr32 |
TTP |
Detect Renamed PSExec |
System Services, Service Execution |
Hunting |
Detect Webshell Exploit Behavior |
Server Software Component, Web Shell |
TTP |
Disabling Firewall with Netsh |
Disable or Modify Tools, Impair Defenses |
Anomaly |
Excessive File Deletion In WinDefender Folder |
Data Destruction |
TTP |
Excessive Service Stop Attempt |
Service Stop |
Anomaly |
Exchange PowerShell Abuse via SSRF |
Exploit Public-Facing Application, External Remote Services |
TTP |
Exchange PowerShell Module Usage |
Command and Scripting Interpreter, PowerShell |
TTP |
Executables Or Script Creation In Suspicious Path |
Masquerading |
Anomaly |
Firewall Allowed Program Enable |
Disable or Modify System Firewall, Impair Defenses |
Anomaly |
GPUpdate with no Command Line Arguments with Network |
Process Injection |
TTP |
High Process Termination Frequency |
Data Encrypted for Impact |
Anomaly |
MS Exchange Mailbox Replication service writing Active Server Pages |
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services |
TTP |
Ping Sleep Batch Command |
Virtualization/Sandbox Evasion, Time Based Evasion |
Anomaly |
ProxyShell ProxyNotShell Behavior Detected |
Exploit Public-Facing Application, External Remote Services |
Correlation |
Registry Keys Used For Persistence |
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution |
TTP |
Resize ShadowStorage volume |
Inhibit System Recovery |
TTP |
Rundll32 with no Command Line Arguments with Network |
System Binary Proxy Execution, Rundll32 |
TTP |
SearchProtocolHost with no Command Line with Network |
Process Injection |
TTP |
Services Escalate Exe |
Abuse Elevation Control Mechanism |
TTP |
Suspicious DLLHost no Command Line Arguments |
Process Injection |
TTP |
Suspicious Driver Loaded Path |
Windows Service, Create or Modify System Process |
TTP |
Suspicious GPUpdate no Command Line Arguments |
Process Injection |
TTP |
Suspicious MSBuild Rename |
Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild |
Hunting |
Suspicious Process File Path |
Create or Modify System Process |
TTP |
Suspicious Rundll32 StartW |
System Binary Proxy Execution, Rundll32 |
TTP |
Suspicious Rundll32 no Command Line Arguments |
System Binary Proxy Execution, Rundll32 |
TTP |
Suspicious SearchProtocolHost no Command Line Arguments |
Process Injection |
TTP |
Suspicious microsoft workflow compiler rename |
Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities |
Hunting |
Suspicious msbuild path |
Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild |
TTP |
W3WP Spawning Shell |
Server Software Component, Web Shell |
TTP |
Windows Driver Load Non-Standard Path |
Rootkit, Exploitation for Privilege Escalation |
TTP |
Windows Drivers Loaded by Signature |
Rootkit, Exploitation for Privilege Escalation |
Hunting |
Windows Exchange Autodiscover SSRF Abuse |
Exploit Public-Facing Application, External Remote Services |
TTP |
Windows MSExchange Management Mailbox Cmdlet Usage |
Command and Scripting Interpreter, PowerShell |
Anomaly |
Windows Modify Registry EnableLinkedConnections |
Modify Registry |
TTP |
Windows Modify Registry LongPathsEnabled |
Modify Registry |
Anomaly |
Windows RDP Connection Successful |
RDP Hijacking |
Hunting |
Windows Raw Access To Disk Volume Partition |
Disk Structure Wipe, Disk Wipe |
Anomaly |
Windows Raw Access To Master Boot Record Drive |
Disk Structure Wipe, Disk Wipe |
TTP |
Windows Vulnerable Driver Loaded |
Windows Service |
Hunting |
Reference
source | version: 1