Analytics Story: Black Basta Ransomware

Date: 2025-02-03 ID: b543afc8-2b65-49d7-8325-a9bca4fd65c8 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches for suspicious behaviors associated with Black Basta ransomware, focusing on key indicators such as process execution, registry modifications, and network activity. Monitor for unusual file encryption patterns, particularly involving cmd.exe, powershell.exe, or wmic.exe executing with arguments linked to volume shadow copy deletion (vssadmin delete shadows). Look for registry changes disabling security features or altering startup configurations. Track high-volume file modifications in rapid succession, indicative of ransomware encryption. Additionally, unauthorized remote service executions. Cross-reference endpoint logs, EDR alerts, and SIEM detections to correlate malicious activity. Behavioral analytics and heuristic-based detections can enhance visibility into evolving tactics. Implement robust monitoring and response mechanisms to mitigate Black Basta’s impact effectively.

Why it matters

Black Basta ransomware is a highly sophisticated and fast-moving threat that has been targeting organizations worldwide, often disrupting critical operations and demanding hefty ransoms. It operates as a double extortion ransomware, encrypting victim data while simultaneously exfiltrating it to pressure victims into paying. The attack typically begins with initial access via phishing emails, compromised credentials, or exploitation of vulnerabilities in remote desktop services. Once inside, attackers escalate privileges, disable security defenses, and deploy the ransomware payload. The malware rapidly encrypts files across local and networked drives, deleting shadow copies to prevent recovery. It often abuses legitimate system tools like wmic.exe and rundll32.exe, to evade detection. Simultaneously, it establishes command-and-control (C2) connections to exfiltrate sensitive data. The impact is severe—disrupting business operations, exposing confidential information, and leaving organizations with few options for recovery. Early detection, network segmentation, and strong endpoint defenses are crucial to mitigating the risk posed by Black Basta.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
ESXi Account Modified	Local Account, Valid Accounts, Account Manipulation	Anomaly
ESXi Audit Tampering	Impair Command History Logging, Indicator Removal	TTP
ESXi Bulk VM Termination	Virtual Machine Discovery, System Shutdown/Reboot, Endpoint Denial of Service	TTP
ESXi Download Errors	Patch System Image, Disable or Modify Tools	Anomaly
ESXi Encryption Settings Modified	Impair Defenses	TTP
ESXi External Root Login Activity	Valid Accounts	Anomaly
ESXi Firewall Disabled	Disable or Modify System Firewall	TTP
ESXi Lockdown Mode Disabled	Impair Defenses	TTP
ESXi Loghost Config Tampering	Impair Defenses	TTP
ESXi Malicious VIB Forced Install	vSphere Installation Bundles	TTP
ESXi Reverse Shell Patterns	Command and Scripting Interpreter	TTP
ESXi Sensitive Files Accessed	/etc/passwd and /etc/shadow, Data from Local System	TTP
ESXi Shared or Stolen Root Account	Valid Accounts	Anomaly
ESXi Shell Access Enabled	Remote Services	TTP
ESXi SSH Brute Force	Brute Force	Anomaly
ESXi SSH Enabled	SSH	TTP
ESXi Syslog Config Change	Impair Command History Logging	TTP
ESXi System Clock Manipulation	Timestomp	TTP
ESXi System Information Discovery	System Information Discovery	TTP
ESXi User Granted Admin Role	Account Manipulation, Valid Accounts	TTP
ESXi VIB Acceptance Level Tampering	Impair Defenses	TTP
ESXi VM Discovery	Virtual Machine Discovery	TTP
ESXi VM Exported via Remote Tool	Data from Local System	TTP
Bcdedit Command Back To Normal Mode Boot	Inhibit System Recovery	TTP
Change To Safe Mode With Network Config	Inhibit System Recovery	TTP
Common Ransomware Extensions	Data Destruction	TTP
Common Ransomware Notes	Data Destruction	Hunting
Deleting Shadow Copies	Inhibit System Recovery	TTP
Detect RClone Command-Line Usage	Automated Exfiltration	TTP
Detect Renamed RClone	Automated Exfiltration	Hunting
Disable Defender AntiVirus Registry	Disable or Modify Tools	TTP
Disable Windows Behavior Monitoring	Disable or Modify Tools	TTP
Modification Of Wallpaper	Defacement	TTP
Print Spooler Adding A Printer Driver	Print Processors	TTP
Print Spooler Failed to Load a Plug-in	Print Processors	TTP
Ransomware Notes bulk creation	Data Encrypted for Impact	Anomaly
Spoolsv Spawning Rundll32	Print Processors	TTP
Spoolsv Suspicious Loaded Modules	Print Processors	TTP
Spoolsv Suspicious Process Access	Exploitation for Privilege Escalation	TTP
Spoolsv Writing a DLL	Print Processors	TTP
Spoolsv Writing a DLL - Sysmon	Print Processors	TTP
Windows Curl Download to Suspicious Path	Ingress Tool Transfer	TTP
Windows High File Deletion Frequency	Data Destruction	Anomaly
Detect Zerologon via Zeek	Exploit Public-Facing Application	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 10	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 26	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
VMWare ESXi Syslog	N/A	`vmw-syslog`	`vmware:esxlog`
Windows Event Log Printservice 316	Windows	`WinEventLog`	`WinEventLog:Microsoft-Windows-PrintService/Admin`
Windows Event Log Printservice 4909	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Printservice 808	Windows	`WinEventLog`	`WinEventLog:Microsoft-Windows-PrintService/Admin`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a

Source: GitHub | Version: 1