Skip to content
skopnix
Detections
← All detectionsLinked actor

blackbyte

38 rules17 findings

The blackbyte dossier →

  1. Behaviour (ATT&CK technique)

    Shadow copy or backup catalog deletion (T1490)

    Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

    blackbyte · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · Void Manticore · 1 more

    T1490conf 85SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 76 more

    T1105conf 80SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 71 more

    T1059.001conf 80SIGAQLXQL

  4. Behaviour (ATT&CK technique)

    Microsoft Defender protection disabled via Set-MpPreference (T1685)

    Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

    APT2 · APT35 · APT5 · blackbyte · Contagious Interview · FIN6 · 21 more

    T1685conf 75SIGAQLXQL

  5. Behaviour (ATT&CK technique)

    AdFind domain trust or controller enumeration (T1482)

    Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.

    APT35 · blackbyte · Chimera · Earth Lusca · FIN8 · LOTUS PANDA · 4 more

    T1482conf 70SIGAQLXQL

  6. CVE exploitation

    CVE-2021-34473 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-34473 · APT35 · blackbyte · BRONZE STARLIGHT · Witchetty

    T1190conf 70SIGAQLXQL

  7. Actor indicator sweep

    blackbyte domain indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1071conf 82SIGAQLXQL

  8. Actor indicator sweep

    blackbyte file hash indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1204.002conf 72SIGAQLXQL

  9. Indicator

    Known-malicious file hash observed

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  10. Indicator

    Malicious Hashes

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  11. Indicator

    Connection to known-malicious domain

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT-C-36 · blackbyte · BRONZE STARLIGHT · Inception Framework · RUBYCARP · ShinyHunters · 2 more

    T1071conf 71AQL

  12. Indicator

    Malicious Domains

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT-C-36 · blackbyte · BRONZE STARLIGHT · Inception Framework · RUBYCARP · ShinyHunters · 2 more

    T1071conf 71AQL

  13. Indicator

    DNS query for known malicious domain file.io

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1071conf 82SIGXQL

  14. Indicator

    Execution of known malicious file 1df11bc19aa52b62…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 77SIGXQL

  15. Indicator

    Execution of known malicious file 0097b8722c8c0840…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 72SIGXQL

  16. Indicator

    Execution of known malicious file 3fb160e1770fafee…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 72SIGXQL

  17. Indicator

    Execution of known malicious file 884e96a75dc56807…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 72SIGXQL

How to deploy

SIGSigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

AQLIBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

XQLCortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.