Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

ALPHV/BlackCat – Rust Encryptor Invocation with Known CLI Flags

Alphv Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
CISA AA23-353A (#StopRansomware: ALPHV Blackcat)
What This Detects
The ALPHV/BlackCat Rust-based encryptor is invoked with a distinctive set of command-line flags (--access-token, --no-prop, --safe-mode, --encrypt-network) documented by CISA. Flags any process launched with these switches.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("--access-token","--no-prop","--safe-mode","-safe-mode","--encrypt-network","--paths")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.