Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Black Basta – Backstab EDR-Kill Driver Dropped Outside Program Files

Blackbasta Defense Evasion Sentinel
MITRE ATT&CK
DLL
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (blackbasta)
What This Detects
Black Basta uses the 'Backstab' tool (a signed Process Explorer driver, procexp.sys/procexp64.sys) dropped into a writable, non-standard path to terminate EDR/AV processes ahead of encryption.
Query
DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName in~ ("procexp.sys","procexp64.sys","backstab.exe")
| where FolderPath has_any (@"\Windows\Temp\", @"\Users\Public\", @"\ProgramData\")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.