BlackByte Ransomware Registry Modifications

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects specific Windows registry modifications made by BlackByte ransomware variants. BlackByte sets three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the specified registry keys are set to DWORD 1.