Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

ALPHV/BlackCat – Rust Encryptor Invocation with Known CLI Flags

Alphv Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
CISA AA23-353A (#StopRansomware: ALPHV Blackcat)
What This Detects
The ALPHV/BlackCat Rust-based encryptor is invoked with a distinctive set of command-line flags (--access-token, --no-prop, --safe-mode, --encrypt-network) documented by CISA. Flags any process launched with these switches.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("--access-token","--no-prop","--safe-mode","-safe-mode","--encrypt-network","--paths")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.