Potential BlackByte Ransomware Activity

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•25

Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.