Analytics Story: Black Basta Ransomware

Updated Date: 2026-05-13 ID: b543afc8-2b65-49d7-8325-a9bca4fd65c8 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches for suspicious behaviors associated with Black Basta ransomware, focusing on key indicators such as process execution, registry modifications, and network activity. Monitor for unusual file encryption patterns, particularly involving cmd.exe, powershell.exe, or wmic.exe executing with arguments linked to volume shadow copy deletion (vssadmin delete shadows). Look for registry changes disabling security features or altering startup configurations. Track high-volume file modifications in rapid succession, indicative of ransomware encryption. Additionally, unauthorized remote service executions. Cross-reference endpoint logs, EDR alerts, and SIEM detections to correlate malicious activity. Behavioral analytics and heuristic-based detections can enhance visibility into evolving tactics. Implement robust monitoring and response mechanisms to mitigate Black Basta’s impact effectively.

Why it matters

Black Basta ransomware is a highly sophisticated and fast-moving threat that has been targeting organizations worldwide, often disrupting critical operations and demanding hefty ransoms. It operates as a double extortion ransomware, encrypting victim data while simultaneously exfiltrating it to pressure victims into paying. The attack typically begins with initial access via phishing emails, compromised credentials, or exploitation of vulnerabilities in remote desktop services. Once inside, attackers escalate privileges, disable security defenses, and deploy the ransomware payload. The malware rapidly encrypts files across local and networked drives, deleting shadow copies to prevent recovery. It often abuses legitimate system tools like wmic.exe and rundll32.exe, to evade detection. Simultaneously, it establishes command-and-control (C2) connections to exfiltrate sensitive data. The impact is severe—disrupting business operations, exposing confidential information, and leaving organizations with few options for recovery. Early detection, network segmentation, and strong endpoint defenses are crucial to mitigating the risk posed by Black Basta.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Deleting Shadow Copies	Inhibit System Recovery	TTP
ESXi Reverse Shell Patterns	Command and Scripting Interpreter	TTP
Print Spooler Failed to Load a Plug-in	Print Processors	TTP
ESXi VM Discovery	Virtual Machine Discovery	TTP
Spoolsv Writing a DLL - Sysmon	Print Processors	TTP
Windows Curl Download to Suspicious Path	Ingress Tool Transfer	TTP
ESXi Shell Access Enabled	Remote Services	TTP
Spoolsv Suspicious Loaded Modules	Print Processors	TTP
ESXi Loghost Config Tampering	Disable or Modify Tools	TTP
ESXi Syslog Config Change	Prevent Command History Logging	TTP
ESXi Shared or Stolen Root Account	Valid Accounts	Anomaly
ESXi User Granted Admin Role	Valid Accounts, Account Manipulation	TTP
Detect Zerologon via Zeek	Exploit Public-Facing Application	TTP
Disable Defender AntiVirus Registry	Disable or Modify Tools	TTP
Change To Safe Mode With Network Config	Inhibit System Recovery	TTP
Bcdedit Command Back To Normal Mode Boot	Inhibit System Recovery	TTP
ESXi Malicious VIB Forced Install	vSphere Installation Bundles	TTP
ESXi Download Errors	Patch System Image, Disable or Modify Tools	Anomaly
ESXi VIB Acceptance Level Tampering	Disable or Modify Tools	TTP
Windows High File Deletion Frequency	Data Destruction	Anomaly
ESXi Bulk VM Termination	Endpoint Denial of Service, System Shutdown/Reboot, Virtual Machine Discovery	TTP
Detect RClone Command-Line Usage	Automated Exfiltration	TTP
ESXi System Clock Manipulation	Timestomp	TTP
ESXi SSH Brute Force	Brute Force	Anomaly
ESXi Sensitive Files Accessed	/etc/passwd and /etc/shadow, Data from Local System	TTP
Detect Renamed RClone	Automated Exfiltration	Hunting
Modification Of Wallpaper	Defacement	TTP
ESXi External Root Login Activity	Valid Accounts	Anomaly
Disable Windows Behavior Monitoring	Disable or Modify Tools	TTP
ESXi Encryption Settings Modified	Disable or Modify Tools	TTP
Spoolsv Spawning Rundll32	Print Processors	TTP
Print Spooler Adding A Printer Driver	Print Processors	TTP
ESXi Firewall Disabled	Disable or Modify System Firewall	TTP
Ransomware Notes bulk creation	Data Encrypted for Impact	Anomaly
ESXi VM Exported via Remote Tool	Data from Local System	TTP
Common Ransomware Extensions	Data Destruction	TTP
ESXi System Information Discovery	System Information Discovery	TTP
Common Ransomware Notes	Data Destruction	Hunting
ESXi Lockdown Mode Disabled	Disable or Modify Tools	TTP
Spoolsv Writing a DLL	Print Processors	TTP
ESXi Account Modified	Valid Accounts, Account Manipulation, Local Account	Anomaly
ESXi Audit Tampering	Indicator Removal, Prevent Command History Logging	TTP
Spoolsv Suspicious Process Access	Exploitation for Privilege Escalation	TTP
ESXi SSH Enabled	SSH	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
VMWare ESXi Syslog	Other	`vmw-syslog`	`vmware:esxlog`
Windows Event Log Printservice 808	Windows	`WinEventLog`	`WinEventLog:Microsoft-Windows-PrintService/Admin`
Windows Event Log Printservice 4909	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 26	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Printservice 316	Windows	`WinEventLog`	`WinEventLog:Microsoft-Windows-PrintService/Admin`
Sysmon EventID 10	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a

Source: GitHub | Version: 2