2022_BlackCat_Ransomware

Suspicious BlackCat-Related Exfiltration Command

Sep 1, 2023 · attack.exfiltration attack.t1020 attack.t1537 ·

Detects process execution of RClone or similar tools used by ransomware operators to exfiltrate data.

Suspicious Registry Key Added: LanmanServer Parameters

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Detects registry addition for LanmanServer MaxMpxCt. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Registry Key Set (MaxMpxCt)

Jan 12, 2023 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry value set to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.

Suspicious Command Line Indicating BlackCat Execution

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·

Share on:

Detects process execution with the --access-token flag accompanied by a 64-character alphanumeric string in the space-delimited command-line arguments..

Suspicious Command Line Indicating BlackCat Execution with Get UUID Option

Dec 6, 2022 · attack.execution attack.t1059 attack.t1204 ·

Share on:

Detects process execution with the --access-token flag accompanied by a child process with a 'get uuid' option.

Suspicious Fsutil Execution Allowing Remote Connections

Dec 6, 2022 · attack.persistence attack.t1547 ·

Share on:

Detects the use of fsutil to permit additional types of symbolic links on a computer. These can be used to enable ransomware to follow shortcusts to find all files it wants to encrypt.

Suspicious Process Execution in PerfLogs Directory

Dec 6, 2022 · attack.defense_evasion attack.t1564 ·

Share on:

Detects process execution in PerfLogs folder - a folder used by Windows for log collection - and matching previously-observed naming patterns for ransomware executables.

Suspicious Registry Modification of MaxMpxCt Parameters

Dec 6, 2022 · attack.command_and_control attack.defense_evasion attack.t1105 attack.t1562 ·

Share on:

Detects registry modifications to change MaxMpxCt settings. BlackCat does this to increase the number of outstanding requests allowed, such as SMB requests to distribute ransomware through an environment.