hightestEmerging Threat
Potential BlackByte Ransomware Activity
Detects command line patterns used by BlackByte ransomware in different operations
windowsprocess_creation2 samples
2023-02-08
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
hightestEmerging Threat
Blackbyte Ransomware Registry
Detects specific windows registry modifications made by BlackByte ransomware variants. BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.
windowsregistry_set2 samples
2025-10-21