Moderate Threat Hunting Guide Active TLP:CLEAR

Booba Project Hunting Guide

Seven behavioral hunt modules (11 KQL, 4 SPL, 3 Sigma) for double-extortion pre-encryption activity, including a module for law firms and their document stores.

HUNT MODULES

HUNT QUERIES

PUBLISHED HASHES

3 / 6

RECENT VICTIMS: LAW

Validation note: these queries are untested in Intruvent lab; validate in your environment before production use.

01· EXECUTIVE SUMMARY

No hashes, no C2 addresses: hunt the behaviors the operation cannot skip

THREAT: MODERATE · ACTOR: BOOBA PROJECT (UNATTRIBUTED) · MODEL: DOUBLE EXTORTION · COMPANION: INT-TAP-2026-BOOBAPROJECT-v1.1

WHAT

Booba Project is a financially motivated ransomware group that surfaced in late June 2026 and runs a double-extortion model: steal data, then encrypt. [1][6] As of 21 September 2026 it had claimed 18 victims across six countries and advertised about 496 GB of stolen data, with claimed theft per victim ranging from 1.4 GB to 92 GB. [1][5] No malware hashes, command-and-control addresses, or malware analysis have been published for this group as of 24 September 2026. [6] The only group-specific artifacts are a ransom note filename (booba.txt), a contact address, and three Tor services. [1]

SO WHAT

With no signature surface, detection depends on the stages every double-extortion intrusion must pass through before the ransom note appears: account access, bulk collection, archive staging, large outbound transfer, and recovery sabotage. Three of the group's six victims posted since 24 August are law practices, against roughly 2% of all leak-site victims across tracked groups in the same 30-day window. [5] Half of the first 16 victim organizations had domains linked to infostealer data, which points to stolen credentials as a probable entry vector. [1] The hunts in this guide are not Booba-specific signatures. They cover behaviors this group's operations require, so they will also surface other actors and some legitimate activity.

NOW WHAT

Start with Modules 01 (infostealer-exposed accounts) and 05 (large outbound transfers); they are the critical path because they cover the probable entry and the extortion lever. Law firms should run Module 03 (bulk document access) in the same session. Run Module 07 (ransom note) as a standing alert: a hit there means encryption has started and the pre-encryption window has closed. Every query is untested in the Intruvent lab; treat first runs as validation runs and tune thresholds to your baseline.

02· HOW TO USE THIS GUIDE

Who runs what, what you need first, and what a result means

EXECUTIVES

Read Sections 01 and 03. Law-firm leadership should also read the Module 03 background. Clients that share matters with outside counsel can use Module 03 as the basis for a vendor-risk question: does your firm alert on bulk exports from its document stores?

IAM / IT ADMINS

Own the response side of Modules 01 and 02 (credential resets, session revocation, RDP exposure). Modules 03 and 06 depend on audit settings you control; confirm they are enabled before the hunt.

HUNTERS / SOC

Own all seven modules and Appendix B. Queries are provided in KQL (Microsoft Defender XDR advanced hunting and Microsoft Sentinel), SPL (Splunk, against the Common Information Model), and Sigma. Replace every threshold, watchlist name, and index with values from your environment.

PREREQUISITES

At least one of: Microsoft Defender for Endpoint telemetry, Sentinel with Entra ID sign-in and risk logs, or Splunk with the Endpoint and Network_Traffic data models populated. Firewall or proxy logs that record bytes sent per session. Windows file-share auditing (event 5145) on servers holding client or matter files. An infostealer or breach-exposure feed for your domains, if you subscribe to one. Written authorization to hunt.

LOOKBACK

Use at least 30 days. The average delay between estimated attack date and leak-site posting was 10.2 days across the first 16 victims, [1] and dwell time before encryption has not been published for this group. A shorter window can miss the staging and exfiltration that preceded a posting.

READING A RESULT

No single hit confirms a Booba Project intrusion, and most hits will be benign. Preserve evidence, scope the hit against the module's WHAT TO LOOK FOR guidance, and corroborate with a second module. The strongest signal is a chain on one account or host: exposed credential, then bulk access, then archive creation, then a large outbound transfer.

ESCALATION

A corroborated chain, any shadow-copy deletion outside change control, or any booba.txt file warrants incident response. Isolate affected hosts, revoke sessions for involved accounts, protect backups, and preserve logs before remediation. Do not contact the group's email or Tor services from corporate infrastructure.

SAFETY LABELS

Every query carries one label. DETECTION ONLY: broad pattern that will include legitimate activity; alert and triage only. INVESTIGATION AID: manual hunt or scoping query; not for production alerting as written. No query in this guide is labeled blocking-safe.

VALIDATION STATUS

All 18 queries are untested in the Intruvent lab. Field and table names were checked statically against Microsoft, Splunk, and SigmaHQ published material (Appendix C). Validate field names and thresholds in your environment before relying on any result, and treat a query that returns an error or zero rows as a coverage gap to investigate, not a clean result.

Glossary. C2: command and control. CIM: Splunk Common Information Model (normalized field names). DMS: document management system (the platform a law firm uses to store and version client matter files). Double extortion: data theft plus encryption, with payment demanded for both decryption and non-publication. EDR: endpoint detection and response. Infostealer: malware that harvests saved passwords and session cookies from infected machines; its output is sold as "logs." KQL: Kusto Query Language (Microsoft Defender XDR and Sentinel). MFA: multifactor authentication. RDP: Remote Desktop Protocol. Sigma: vendor-neutral detection rule format. SPL: Splunk Search Processing Language. TLP: Traffic Light Protocol. VSS: Volume Shadow Copy Service (Windows point-in-time snapshots used for recovery).

03· THREAT PROFILE

Booba Project at a glance

THREAT ACTOR

Booba Project (alias booba_project). Unclustered: no nation-state attribution and no vendor clustering. Not present in Intruvent Codex as of 24 September 2026. [2][3][7]

FIRST OBSERVED

Earliest estimated attack date 24 June 2026; first leak-site discovery 06 July 2026. [1]

VICTIMS

18 claimed across six countries (United States 11). Professional services 7, including 3 law practices; technology 4; manufacturing 2; one each in insurance, food and beverages, public-safety communications, construction, and travel. [1][5][6]

CLAIMED THEFT

1.4 GB to 92 GB per victim; about 16 GB per victim in July and about 52 GB per victim across the six postings since 24 August. Volumes are the group's own claims. [1][5]

ENTRY VECTORS

Probable: valid credentials from infostealer logs (50% of the first 16 victims had infostealer-linked domains). [1] Reported more broadly for this type of operation: phishing, RDP exploitation, spam campaigns. None confirmed through published forensic analysis of a Booba Project intrusion. [4][6]

MAPPED TECHNIQUES

T1074 Data Staged, T1041 Exfiltration Over C2 Channel, T1537 Transfer Data to Cloud Account, T1486 Data Encrypted for Impact. [2][3] Mapped from leak-site tracking, not malware analysis.

GROUP ARTIFACTS

Ransom note booba.txt; contact boobaproject@proton.me; three Tor services (leak site, negotiation portal, file storage); Telegram channels for victim announcements. [1][4]

Phishing is a reported vector, [4] but email filtering and awareness controls sit outside a hunting guide. This guide hunts for what a phished or stolen credential does next. The MODERATE rating is carried from the companion TAP and reflects limited operational history and no documented novel tradecraft. [6]

04· MITRE ATT&CK MAPPING

Two kinds of mapping appear below. TAP-MAPPED techniques are attributed to Booba Project by threat-intelligence aggregators. [2][3] COVERAGE techniques are behaviors that double-extortion operations commonly require or that the TAP lists as reported vectors; they are hunted here as coverage and are not confirmed for this group. Technique definitions per MITRE ATT&CK. [8]

MITRE IDTECHNIQUEBASIS · MODULE

T1074Data StagedTAP-MAPPED. Structured collection implied by advertised per-victim volumes. [2][3] · Modules 03, 04

T1041Exfiltration Over C2 ChannelTAP-MAPPED. Data reportedly transferred out before encryption. [2][3] · Module 05

T1537Transfer Data to Cloud AccountTAP-MAPPED. Some exfiltration reportedly routed through cloud storage intermediaries. [2] · Module 05

T1486Data Encrypted for ImpactTAP-MAPPED. Encryption follows exfiltration; ransom note booba.txt dropped. [1][2] · Module 07

T1078Valid AccountsCOVERAGE. Infostealer correlation suggests stolen credentials as a probable entry vector. [1] · Module 01

T1133External Remote ServicesCOVERAGE. RDP exploitation reported for this type of operation; unconfirmed for this group. [4] · Module 02

T1039Data from Network Shared DriveCOVERAGE. Bulk reads from file shares and document stores precede staging. · Module 03

T1560.001Archive Collected Data: Archive via UtilityCOVERAGE. Common staging step before transfer; Codex maps it to 55 tracked actors. [7] · Module 04

T1567.002Exfiltration to Cloud StorageCOVERAGE. Adjacent to the TAP's T1537 mapping; tools such as rclone push data to cloud storage. [9] · Module 05

T1490Inhibit System RecoveryCOVERAGE. Standard pre-encryption step; Codex maps it to 68 tracked actors. [7] Listed as a hunt priority in the TAP. [6] · Module 06

05· HUNT MAP

Seven modules in intrusion order; run 01 and 05 first

NOMODULEATT&CKPRIORITY

01Infostealer-Exposed Accounts in UseT1078CRITICAL

02Internet-Facing RDP AccessT1133HIGH

03Law Firms: Bulk Document Access and ExportT1039HIGH

04Bulk Archive Creation (Staging)T1074 / T1560.001CRITICAL

05Large Outbound Transfers and Cloud UploadsT1041 / T1537CRITICAL

06Backup and Shadow Copy TamperingT1490HIGH

07Ransom Note Creation (booba.txt)T1486HIGH

Priorities follow the companion TAP's detection table. [6] For law firms, treat Module 03 as CRITICAL: three of the group's six most recent victims are law practices. [5]

06· HUNT MODULES

BEFORE YOU RUN ANYTHING

These are behavioral hunts, not Booba Project signatures. Every query below is untested in the Intruvent lab: validate field names and thresholds in your environment, and expect legitimate hits (backup jobs, admin archiving, cloud sync, e-discovery exports). Thresholds are starting points chosen against the group's smallest claimed theft (1.4 GB), [1] not tuned values. Queries are read-only; wide Splunk tstats searches and 90-day Defender lookbacks should run off-peak.

Infostealer-Exposed Accounts in Use

T1078 · PRIORITY CRITICAL

OBJECTIVEFind accounts whose credentials are known to be exposed and that are still signing in successfully, especially without MFA or from unfamiliar locations.

Background

Half of the first 16 Booba Project victims had domains linked to infostealer data, per ransomware.live as of 04 September 2026. [1] That does not prove those credentials were the entry point, but it makes exposed credentials the first place to look. Microsoft Entra ID Protection raises a leakedCredentials user risk detection when credentials found in breach dumps, dark web forums, or paste sites match a user's current password; it is available at the Entra ID Free and P1 tiers, is calculated offline, and requires password hash synchronization for on-premises passwords. [13] Commercial infostealer feeds cover sources Microsoft may not; Q2 joins your feed's output through a Sentinel watchlist. [14]

Step 1 · Leaked-credential detections with successful sign-ins

MICROSOFT SENTINEL (KQL)M01-Q1

// Users with an Entra ID "leakedCredentials" risk detection, and their
// successful sign-ins in the same window. Tables: AADUserRiskEvents, SigninLogs.
let lookback = 30d;
let leaked = AADUserRiskEvents
    | where TimeGenerated > ago(lookback)
    | where RiskEventType == "leakedCredentials"
    | extend UserPrincipalName = tolower(UserPrincipalName)
    | summarize FirstLeakDetected = min(DetectedDateTime), RiskStates = make_set(RiskState)
        by UserPrincipalName;
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == "0"
| extend UserPrincipalName = tolower(UserPrincipalName)
| join kind=inner leaked on UserPrincipalName
| extend AfterDetection = TimeGenerated >= FirstLeakDetected
| summarize SignIns = count(), IPs = make_set(IPAddress, 50),
    Countries = make_set(Location, 20), Apps = make_set(AppDisplayName, 20),
    LastSignIn = max(TimeGenerated)
    by UserPrincipalName, FirstLeakDetected, AuthenticationRequirement, AfterDetection
| order by AfterDetection desc, SignIns desc

INVESTIGATION AID · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: Azure Monitor table reference for AADUserRiskEvents and SigninLogs [12]; riskEventType value per Entra ID Protection documentation. [13]

Step 2 · Infostealer-feed matches with successful sign-ins

MICROSOFT SENTINEL (KQL)M01-Q2

// Prerequisite: a Sentinel watchlist (alias used here: InfostealerExposedAccounts)
// built from your infostealer or breach feed, with the account UPN as SearchKey.
let exposed = _GetWatchlist('InfostealerExposedAccounts')
    | project UserPrincipalName = tolower(SearchKey);
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == "0"
| extend UserPrincipalName = tolower(UserPrincipalName)
| join kind=inner exposed on UserPrincipalName
| summarize SignIns = count(), IPs = make_set(IPAddress, 50),
    Countries = make_set(Location, 20), Apps = make_set(AppDisplayName, 20),
    SingleFactor = countif(AuthenticationRequirement == "singleFactorAuthentication")
    by UserPrincipalName
| order by SingleFactor desc, SignIns desc

INVESTIGATION AID · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: Sentinel watchlist query syntax [14]; SigninLogs table reference. [12] The watchlist alias is an Intruvent placeholder; use your own.

WHAT TO LOOK FOR

Exposed accounts with successful single-factor sign-ins, sign-ins from countries or networks the user has never used, and access to VPN, remote desktop gateways, or file-sharing apps shortly after exposure. Response for any exposed account: force a password reset, revoke refresh tokens and sessions, and review what the account touched (feed the account into Modules 03 to 05).

Internet-Facing RDP Access

T1133 · PRIORITY HIGH

OBJECTIVEIdentify successful and failed Remote Desktop logons from public IP addresses, and bursts of RDP connection attempts that suggest brute forcing.

Background

RDP exploitation is a reported vector for ransomware operations of this type, but no published forensic analysis confirms it for a Booba Project intrusion. [4][6] The hunt is still cheap and high value: any RDP logon from the public internet is an exposure to close regardless of who is behind it.

Step 1 · RDP logons from public addresses (Defender for Endpoint)

DEFENDER XDR ADVANCED HUNTING (KQL)M02-Q1

// RemoteInteractive = RDP logon session. Confirm the exact LogonType string
// in your tenant's in-portal schema reference before relying on zero results.
DeviceLogonEvents
| where Timestamp > ago(30d)
| where LogonType == "RemoteInteractive"
| where RemoteIPType == "Public"
| summarize Success = countif(ActionType == "LogonSuccess"),
    Failed = countif(ActionType == "LogonFailed"),
    Accounts = make_set(AccountName, 20),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, RemoteIP
| order by Success desc, Failed desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: DeviceLogonEvents schema (LogonType, RemoteIPType, ActionType). [11] With Network Level Authentication, failed RDP attempts may log as Network logons; widen the LogonType filter if Failed is always zero.

Step 2 · RDP connection bursts (Splunk)

SPLUNK SPLM02-Q2

``` Adapted from Splunk ESCU "Windows Remote Desktop Network Bruteforce Attempt"
    (908bf0d5-0983-4afd-b6a4-e9eb5d361a7d); ESCU macros removed, grouping reduced. ```
| tstats count min(_time) as firstTime max(_time) as lastTime
    from datamodel=Network_Traffic
    where (All_Traffic.app=rdp OR All_Traffic.dest_port=3389)
    by All_Traffic.src_ip All_Traffic.dest All_Traffic.action
| rename "All_Traffic.*" as *
| eval duration=lastTime-firstTime
| where count > 10 AND duration < 3600
| convert ctime(firstTime) ctime(lastTime)
| sort - count

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: Splunk security_content detection 908bf0d5 (thresholds count > 10 and duration < 3600 s carried from the original). [10]

SOURCE IP HANDLING

RDP source addresses will include residential ISPs, VPN exit nodes, and cloud hosts. Do not blocklist them from this hunt. Close the exposure instead: remove direct internet RDP, require a gateway with MFA, and verify any successful public logon with the account holder.

Law Firms: Bulk Document Access and Export

T1039 · PRIORITY HIGH (LAW: CRITICAL)

OBJECTIVEDetect a single account reading or downloading an unusual number of files from the stores that hold client matter data: Windows file shares, SharePoint and OneDrive, and the firm's document management system.

Background

Three of Booba Project's six victims posted since 24 August 2026 are law practices (Mexico, Russia, United States), and the six postings since 24 August averaged about 52 GB of claimed data each. [5] Whether the group selects law firms deliberately or simply uses the access it has is not known; six postings are too few to tell. [6] Either way, a law firm's extortion value sits in its matter files, and collecting tens of gigabytes of them produces an access pattern no single lawyer's normal work does. The companion TAP recommends that law firms restrict bulk access to document platforms and alert on large exports. [6]

Step 1 · Bulk file-share access per account (Windows event 5145)

MICROSOFT SENTINEL (KQL)M03-Q1

// Requires "Audit Detailed File Share" on the file servers that hold matter files.
// 5145 logs each access check on a share object; volume is high, so scope
// Computer to your matter-file servers.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 5145
| where ShareName !in (@"\\*\IPC$", @"\\*\SYSVOL", @"\\*\NETLOGON")
| summarize DistinctObjects = dcount(RelativeTargetName),
    Shares = make_set(ShareName, 10), SourceIPs = make_set(IpAddress, 10)
    by SubjectUserName, Computer, bin(TimeGenerated, 1h)
| where DistinctObjects > 500
| order by DistinctObjects desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: SecurityEvent table reference (EventID, ShareName, RelativeTargetName, IpAddress, SubjectUserName) [12] and Microsoft's event 5145 documentation. [15] The 500-object threshold is a placeholder; baseline per role first.

Step 2 · Bulk downloads from SharePoint and OneDrive

MICROSOFT SENTINEL (KQL)M03-Q2

OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation == "FileDownloaded"
| summarize Downloads = count(), DistinctFiles = dcount(SourceFileName),
    Sites = make_set(Site_Url, 10), ClientIPs = make_set(ClientIP, 10)
    by UserId, bin(TimeGenerated, 1h)
| where DistinctFiles > 200
| order by DistinctFiles desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: OfficeActivity table reference [12]; FileDownloaded operation per Microsoft Purview audit activities. [16] Where licensed, the Entra ID Protection "Mass access to sensitive files" detection (sourced from Defender for Cloud Apps) covers SharePoint and OneDrive. [13]

Step 3 · Document management system audit history

Legal document management platforms (for example iManage or NetDocuments) maintain their own user activity records. This guide does not reproduce product-specific log fields, because Intruvent has not verified them against vendor documentation. Apply the same logic manually or in your SIEM:

Ask your DMS administrator or vendor which events record document views, downloads, exports, and bulk or folder-level exports, and whether those events can be forwarded to your SIEM.
Build a per-user baseline of documents opened or exported per hour and per day, then alert on multiples of that baseline and on any bulk export by an account outside litigation support or records roles.
Correlate DMS export volume with the same account's sign-ins (Module 01) and the same workstation's archive activity (Module 04).
Review which service accounts, sync clients, and integrations hold broad DMS read access; these can collect data without a user session.

WHAT TO LOOK FOR

One account touching hundreds of matters in an hour, access to matters the account has never opened before, activity outside the user's working hours, and service or former-employee accounts reading at volume. Expected false positives: e-discovery collections, litigation-support exports, backup and migration jobs, and OneDrive sync of a newly shared library. Confirm with the matter owner before escalating.

Bulk Archive Creation (Staging)

T1074 / T1560.001 · PRIORITY CRITICAL

OBJECTIVEFind command-line archiving (7-Zip, RAR) that adds files to archives, especially with passwords, and large archive files written to disk.

Background

Booba Project's victim postings advertise specific data volumes, which aggregators map to Data Staged (T1074). [2][3] Staging usually means compressing collected files into a small number of archives before transfer. The tooling Booba uses to stage is not published, so the queries below target the common command-line archivers covered by public SigmaHQ rules. [9]

Step 1 · Command-line archive creation

DEFENDER XDR ADVANCED HUNTING (KQL)M04-Q1

// Adapted from SigmaHQ 9fbf5927-5261-4284-a71d-f681029ea574 (7-Zip with password)
// and 6f3e2987-db24-4c78-a860-b4f4095a7095 (files added with rar.exe).
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe")
    or ProcessVersionInfoOriginalFileName in~ ("7z.exe", "7za.exe", "7zr.exe")
| where ProcessCommandLine contains " a " or ProcessCommandLine contains " u "
| extend PasswordProtected = ProcessCommandLine contains " -p"
    or ProcessCommandLine contains " -hp"
| summarize Runs = count(), Protected = countif(PasswordProtected),
    SampleCommands = make_set(ProcessCommandLine, 10),
    Parents = make_set(InitiatingProcessFileName, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName
| order by Protected desc, Runs desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: SigmaHQ rules 9fbf5927 and 6f3e2987 [9]; DeviceProcessEvents schema. [11] Both SigmaHQ rules warn that legitimate use is expected.

Step 2 · Large archive files written

DEFENDER XDR ADVANCED HUNTING (KQL)M04-Q2

// 1 GB floor: below the group's smallest claimed theft (1.4 GB). FileSize is
// not populated for every event; empty sizes are dropped by this filter.
DeviceFileEvents
| where Timestamp > ago(30d)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName endswith ".7z" or FileName endswith ".rar" or FileName endswith ".zip"
| where FileSize > 1073741824
| project Timestamp, DeviceName, FolderPath, FileName,
    SizeGB = round(FileSize / 1073741824.0, 2),
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    InitiatingProcessAccountName
| order by SizeGB desc

INVESTIGATION AID · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: DeviceFileEvents schema (ActionType, FileSize, InitiatingProcess columns). [11] Confirm ActionType values in the in-portal schema reference.

WHAT TO LOOK FOR

Password-protected archives created on file servers or by accounts that do not normally archive, archives written to user-writable or public folders (for example C:\Users\Public or C:\ProgramData), archiver binaries run from unusual paths, and archive creation on the same host or account flagged in Modules 01 to 03. Expected false positives: backup software, software builds, and users zipping deliverables.

Large Outbound Transfers and Cloud Uploads

T1041 / T1537 · PRIORITY CRITICAL

OBJECTIVEFind internal hosts that sent gigabytes to external destinations in a short window, and find command-line cloud sync tools used for exfiltration.

Background

Aggregators map Booba Project to Exfiltration Over C2 Channel (T1041) and Transfer Data to Cloud Account (T1537); some exfiltration was reportedly routed through cloud storage intermediaries. [2][3] Claimed theft ranges from 1.4 GB to 92 GB per victim. [1] Volume is the durable signal: the destination can be any cloud or hosting provider, but tens of gigabytes leaving one internal host in hours is rare outside backup and sync traffic you can allowlist. SigmaHQ and Splunk both publish detections for rclone, a cloud sync tool that multiple ransomware operations have used for exfiltration. [9][10]

Step 1 · Outbound volume per host pair (firewall / proxy via CEF)

MICROSOFT SENTINEL (KQL)M05-Q1

// SentBytes population depends on the firewall vendor and whether it logs
// session totals. Allowlist backup and replication destinations after first run.
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| where ipv4_is_private(SourceIP) and not(ipv4_is_private(DestinationIP))
| summarize SentGB = round(sum(SentBytes) / 1073741824.0, 2),
    Records = count(), DestHosts = make_set(DestinationHostName, 10),
    Vendors = make_set(DeviceVendor, 5)
    by SourceIP, DestinationIP, bin(TimeGenerated, 1h)
| where SentGB >= 1.0
| order by SentGB desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: CommonSecurityLog table reference (SentBytes, SourceIP, DestinationIP, DestinationHostName, DeviceVendor). [12] Destination addresses will include cloud providers; see the caveat below.

Step 2 · Outbound volume per host pair (Splunk CIM)

SPLUNK SPLM05-Q2

``` Network_Traffic data model; bytes_out summed per source and destination per hour ```
| tstats sum(All_Traffic.bytes_out) as bytes_out
    from datamodel=Network_Traffic
    where All_Traffic.action=allowed
    by All_Traffic.src_ip All_Traffic.dest_ip _time span=1h
| rename "All_Traffic.*" as *
| where cidrmatch("10.0.0.0/8", src_ip) OR cidrmatch("172.16.0.0/12", src_ip) OR cidrmatch("192.168.0.0/16", src_ip)
| where NOT (cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip))
| eval gb_out=round(bytes_out/1073741824, 2)
| where gb_out >= 1
| sort - gb_out

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: Network_Traffic data model usage in Splunk security_content (All_Traffic.* fields in detections 908bf0d5 and 7f5fb3e1). [10] That ESCU detection family also shows a per-source standard-deviation baseline you can substitute for the fixed 1 GB floor.

Step 3 · rclone and renamed rclone

DEFENDER XDR ADVANCED HUNTING (KQL)M05-Q3

// Adapted from SigmaHQ e37db05d-d1f9-49c8-b464-cee1a4b11638 (PUA - Rclone Execution)
// and Splunk ESCU 32e0baea-b3f1-11eb-a2ce-acde48001122. The description match
// catches renamed copies of rclone.exe.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rclone.exe"
    or ProcessVersionInfoFileDescription == "Rsync for cloud storage"
    or (ProcessCommandLine contains "--config "
        and ProcessCommandLine contains "--no-check-certificate "
        and ProcessCommandLine contains " copy ")
| project Timestamp, DeviceName, AccountName, FolderPath, FileName,
    ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: SigmaHQ rule e37db05d [9]; Splunk ESCU "Detect RClone Command-Line Usage" [10]; DeviceProcessEvents schema. [11]

Step 4 · Sigma: rclone execution (SigmaHQ, reproduced without modification)

SIGMAM05-Q4

# Source: SigmaHQ rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml
# Authors: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group
# License: Detection Rule License (DRL) 1.1. Excerpt; see source for references.
title: PUA - Rclone Execution
id: e37db05d-d1f9-49c8-b464-cee1a4b11638
status: test
description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific_options:
        CommandLine|contains|all:
            - '--config '
            - '--no-check-certificate '
            - ' copy '
    selection_rclone_img:
        - Image|endswith: '\rclone.exe'
        - Description: 'Rsync for cloud storage'
    selection_rclone_cli:
        CommandLine|contains:
            - 'pass'
            - 'user'
            - 'copy'
            - 'sync'
            - 'config'
            - 'lsd'
            - 'remote'
            - 'ls'
            - 'mega'
            - 'pcloud'
            - 'ftp'
            - 'ignore-existing'
            - 'auto-confirm'
            - 'transfers'
            - 'multi-thread-streams'
            - 'no-check-certificate '
    condition: selection_specific_options or all of selection_rclone_*
falsepositives:
    - Unknown
level: high

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: SigmaHQ rule as published (status: test). [9] Sites that use rclone for sanctioned backup will need a filter.

DESTINATION HANDLING

Destinations surfaced by Steps 1 and 2 will mostly be cloud storage, CDN, or hosting provider addresses shared with legitimate services. Do not block them at the IP or ASN level on the basis of this hunt. Investigate the source host and account, confirm with the data owner, and contain the host if the transfer is unexplained.

Backup and Shadow Copy Tampering

T1490 · PRIORITY HIGH

OBJECTIVEDetect deletion or shrinking of Volume Shadow Copies, deletion of Windows Server Backup catalogs and versions, and boot configuration changes that disable recovery.

Background

Recovery sabotage is listed as a HIGH-priority hunt in the companion TAP as a standard pre-encryption behavior. [6] It has not been documented for Booba Project specifically, because no incident report or malware analysis is public. [6] Codex maps Inhibit System Recovery (T1490) to 68 tracked actors. [7] This is usually the last step before encryption, so a hit here demands immediate response.

Step 1 · Recovery inhibition commands (Defender for Endpoint)

DEFENDER XDR ADVANCED HUNTING (KQL)M06-Q1

// Adapted from SigmaHQ c947b146-0abc-4c87-9c64-b17e9d7274a2 (shadow copy deletion),
// 1444443e-6757-43e4-9ea4-c8fc705f79a2 (bcdedit tampering), and
// 639c9081-f482-47d3-a0bd-ddee3d4ecd76 (wbadmin delete all backups).
DeviceProcessEvents
| where Timestamp > ago(30d)
| where (FileName in~ ("vssadmin.exe", "wmic.exe", "powershell.exe", "pwsh.exe", "diskshadow.exe")
         and ProcessCommandLine contains "shadow" and ProcessCommandLine contains "delete")
     or (FileName =~ "vssadmin.exe" and ProcessCommandLine contains "resize"
         and ProcessCommandLine contains "shadowstorage"
         and (ProcessCommandLine contains "unbounded" or ProcessCommandLine contains "/MaxSize="))
     or (FileName =~ "wbadmin.exe" and ProcessCommandLine contains "delete"
         and ((ProcessCommandLine contains "catalog" and ProcessCommandLine contains "quiet")
              or (ProcessCommandLine contains "backup" and ProcessCommandLine contains "keepVersions:0")))
     or (FileName =~ "bcdedit.exe" and ProcessCommandLine contains "set"
         and ((ProcessCommandLine contains "bootstatuspolicy" and ProcessCommandLine contains "ignoreallfailures")
              or (ProcessCommandLine contains "recoveryenabled" and ProcessCommandLine contains "no")))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: SigmaHQ rules c947b146, 1444443e, 639c9081 [9]; DeviceProcessEvents schema. [11] SigmaHQ lists legitimate administrator shadow-copy deletion as a false positive.

Step 2 · Shadow copy deletion (Splunk)

SPLUNK SPLM06-Q2

``` Adapted from Splunk ESCU "Deleting Shadow Copies" (b89919ed-ee5f-492c-b139-95dbb162039e);
    ESCU macros removed, grouping reduced. ```
| tstats count min(_time) as firstTime max(_time) as lastTime
    values(Processes.process) as process
    from datamodel=Endpoint.Processes
    where (Processes.process_name=vssadmin.exe OR Processes.process_name=wmic.exe)
      Processes.process=*delete* Processes.process=*shadow*
    by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
| rename "Processes.*" as *
| convert ctime(firstTime) ctime(lastTime)

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: Splunk security_content detection b89919ed. [10]

Step 3 · Sigma: shadow copy deletion (SigmaHQ, reproduced without modification)

SIGMAM06-Q3

# Source: SigmaHQ rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
# Authors: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov,
#   Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)
# License: Detection Rule License (DRL) 1.1. Excerpt; see source for references.
title: Shadow Copies Deletion Using Operating Systems Utilities
id: c947b146-0abc-4c87-9c64-b17e9d7274a2
status: stable
description: Shadow Copies deletion using operating systems utilities
tags:
    - attack.impact
    - attack.stealth
    - attack.t1070
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection1_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\wmic.exe'
              - '\vssadmin.exe'
              - '\diskshadow.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'wmic.exe'
              - 'VSSADMIN.EXE'
              - 'diskshadow.exe'
    selection1_cli:
        CommandLine|contains|all:
            - 'shadow'
            - 'delete'
    selection2_img:
        - Image|endswith: '\wbadmin.exe'
        - OriginalFileName: 'WBADMIN.EXE'
    selection2_cli:
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
            - 'quiet'
    selection3_img:
        - Image|endswith: '\vssadmin.exe'
        - OriginalFileName: 'VSSADMIN.EXE'
    selection3_cli:
        CommandLine|contains|all:
            - 'resize'
            - 'shadowstorage'
        CommandLine|contains:
            - 'unbounded'
            - '/MaxSize='
    condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
falsepositives:
    - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
    - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: SigmaHQ rule as published (status: stable). [9] Inline comments from the source were removed for layout; logic is unchanged.

RESPONSE TRIGGER

Any hit outside a documented change window should be treated as a probable pre-encryption event: isolate the host, check other hosts for the same command within the same hour, and confirm offline or immutable backups are intact before anything else is restored or rebooted.

Ransom Note Creation (booba.txt)

T1486 · PRIORITY HIGH

OBJECTIVEDetect creation of the group's known ransom note filename on any monitored host, and sweep history for earlier occurrences.

Background

The ransom note filename booba.txt is the only group-specific host artifact published for Booba Project. [1] It appears after encryption begins, so it marks the end of the pre-encryption window rather than an early warning. Run it as a standing alert and as a one-time historical sweep. A historical hit on a host with no known incident deserves investigation, since the group claims data theft that precedes encryption. [2]

Step 1 · Defender for Endpoint sweep

DEFENDER XDR ADVANCED HUNTING (KQL)M07-Q1

DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName =~ "booba.txt"
| summarize Notes = count(), Folders = make_set(FolderPath, 20),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath,
       InitiatingProcessAccountName
| order by FirstSeen asc

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: filename per ransomware.live [1]; DeviceFileEvents schema. [11] Advanced hunting retention limits the lookback; use Sentinel or archived data for older history.

Step 2 · Splunk sweep

SPLUNK SPLM07-Q2

``` Adapted from Splunk ESCU "Common Ransomware Notes" (ada0f478-84a8-4641-a3f1-d82362d6bd71),
    with the lookup replaced by the single known Booba Project filename. ```
| tstats count min(_time) as firstTime max(_time) as lastTime
    values(Filesystem.file_path) as file_path
    from datamodel=Endpoint.Filesystem
    where Filesystem.action IN ("created", "modified") Filesystem.file_name="booba.txt"
    by Filesystem.dest Filesystem.user
| rename "Filesystem.*" as *
| convert ctime(firstTime) ctime(lastTime)

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: Splunk security_content detection ada0f478. [10] Alternative: add booba.txt to the ESCU ransomware_notes_lookup so the original detection covers it.

Step 3 · Sigma: booba.txt created

SIGMAM07-Q3

# Intruvent-authored. Single-condition file_event rule; logic basis is the
# published ransom note filename. Not tested against Booba Project telemetry.
title: Booba Project Ransom Note Filename Created
id: 56d34067-df4f-4361-bf3d-309201a70b8d
status: experimental
description: >
  Detects creation of a file named booba.txt, the ransom note filename
  reported for the Booba Project ransomware operation. Late-stage indicator;
  a hit suggests encryption is under way on the host.
references:
    - https://www.ransomware.live/group/Booba%20Project
author: Intruvent Technologies
date: 2026-09-24
tags:
    - attack.impact
    - attack.t1486
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\booba.txt'
    condition: selection
falsepositives:
    - A benign file that happens to share the name; review file content
level: high

DETECTION ONLY · Untested in Intruvent lab; validate field names and thresholds in your environment. Basis: ransom note filename per ransomware.live [1]; Sigma file_event conventions per SigmaHQ. [9] Linux and ESXi coverage is not addressed because no source documents a Booba Project Linux or ESXi encryptor.

IF THIS FIRES

Encryption is probably in progress. Isolate the host and its network segment, preserve the note and a sample of encrypted files, protect backups, and engage incident response. Do not contact the email address or Tor services in the note from corporate systems; negotiation decisions belong with counsel and leadership.

A· APPENDIX: INDICATORS AND HUNT LEADS

These are all of the group-specific indicators published as of 24 September 2026. [1] No hashes, C2 IP addresses, or clearnet domains have been published. [6] The email address and the three onion addresses returned no match in the Intruvent Codex false-positive check, and none is recorded in Codex as a group indicator, because Codex has no Booba Project entry. [7] Behavioral hunt leads are in Modules 01 to 07.

TYPEINDICATORCONTEXT · TIER

HOST ARTIFACT

FILENAMEbooba.txtRansom note filename. [1] Host-artifact detection (Module 07), not a blockable indicator. Tier 3: Investigate.

CONTACT

EMAILboobaproject@proton.meNegotiation contact. [1] Hosted on Proton Mail, a legitimate shared service. Tier 3: Investigate / monitor.

TOR SERVICES

ONION (LEAK)7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onionData leak site. [1] Tier 3: Investigate / monitor.

ONION (NEGOT.)eazk7las3xsvsyxgww3jgzammqjevso2ydnmlopdhl3u2muyrmmilrqd.onionNegotiation portal. [1] Tier 3: Investigate / monitor.

ONION (FILES)d77tnb4bkmj3e366msrzllnwsi2t5e54e4yqh7zm7y5hlfwugnwzswad.onionFile storage server hosting exfiltrated data. [1] Tier 3: Investigate / monitor.

BLOCKING GUIDANCE

Tier 1, Block (High Confidence): none. No dedicated, clearnet-routable infrastructure has been published for this group.

Tier 2, Alert/Monitor (Shared Infrastructure): none listed as indicators. The proton.me mail domain and any cloud storage destinations surfaced by Module 05 are shared services. Do not block proton.me or cloud provider ranges on the basis of this report; blocking them will affect legitimate users and integrations.

Tier 3, Investigate (Unconfirmed): all five entries above. The .onion addresses do not resolve on the public internet, so DNS or firewall blocklists will not match them; their value is intelligence correlation (for example, the addresses appearing in email, chat, browser history, or Tor-enabled proxy logs). Alert on messages sent to or received from the exact address boobaproject@proton.me and treat any hit as a potential active extortion case. The filename booba.txt is a host detection, not a network indicator. Investigate every match before acting; none of these entries is suitable for automated blocking.

B· APPENDIX: DETECTION RULE PROVENANCE

Public detections used as the basis for this guide's queries. Reproduced rules are unmodified in logic; adapted rules are translated to another query language or re-scoped, as noted in each query's comments. Retrieved 24 SEP 2026. [9][10]

Source	Rule	ID	Used in
SigmaHQ	Shadow Copies Deletion Using Operating Systems Utilities	c947b146-0abc-4c87-9c64-b17e9d7274a2	M06-Q1 (adapted), M06-Q3 (reproduced)
SigmaHQ	Boot Configuration Tampering Via Bcdedit.EXE	1444443e-6757-43e4-9ea4-c8fc705f79a2	M06-Q1 (adapted)
SigmaHQ	All Backups Deleted Via Wbadmin.EXE	639c9081-f482-47d3-a0bd-ddee3d4ecd76	M06-Q1 (adapted)
SigmaHQ	PUA - Rclone Execution	e37db05d-d1f9-49c8-b464-cee1a4b11638	M05-Q3 (adapted), M05-Q4 (reproduced)
SigmaHQ	Compress Data and Lock With Password for Exfiltration With 7-ZIP	9fbf5927-5261-4284-a71d-f681029ea574	M04-Q1 (adapted)
SigmaHQ	Files Added To An Archive Using Rar.EXE	6f3e2987-db24-4c78-a860-b4f4095a7095	M04-Q1 (adapted)
Splunk ESCU	Deleting Shadow Copies	b89919ed-ee5f-492c-b139-95dbb162039e	M06-Q2 (adapted)
Splunk ESCU	Detect RClone Command-Line Usage	32e0baea-b3f1-11eb-a2ce-acde48001122	M05-Q3 (adapted)
Splunk ESCU	Common Ransomware Notes	ada0f478-84a8-4641-a3f1-d82362d6bd71	M07-Q2 (adapted)
Splunk ESCU	Windows Remote Desktop Network Bruteforce Attempt	908bf0d5-0983-4afd-b6a4-e9eb5d361a7d	M02-Q2 (adapted)
Intruvent	Booba Project Ransom Note Filename Created	56d34067-df4f-4361-bf3d-309201a70b8d	M07-Q3 (original)

The remaining KQL queries (M01-Q1, M01-Q2, M02-Q1, M03-Q1, M03-Q2, M04-Q2, M05-Q1, M07-Q1) and SPL query M05-Q2 are Intruvent-authored against documented Microsoft table schemas and Splunk data model fields. [10][11][12] Query totals: 11 KQL, 4 SPL, 3 Sigma.

C· APPENDIX: REFERENCES

Bracketed markers in the body, e.g. [1], point to the numbered sources below. Sources [1] to [4] accessed 04 SEP 2026 for the companion TAP; sources [5] to [16] accessed or retrieved 24 SEP 2026.

Ransomware.live. Booba Project group page. Victim list, claimed data volumes, Tor services, ransom note filename, contact email, infostealer correlation. ransomware.live/group/Booba%20Project.
Derp.ca. Booba Project Ransomware Profile. MITRE ATT&CK mappings (T1074, T1486, T1041, T1537), operational model. derp.ca/ransomware/booba-project.
Mallory.ai. Booba Project actor profile. Technique mappings and attribution status (unclustered). mallory.ai/actors/019f3ccc-b689-7222-8cf4-63af0c036d17.
BrinzTech. Breach alert on a July 2026 Booba Project victim. July 2026. Reported vectors and Telegram use. URL withheld (names victim); held in Intruvent research files.
Intruvent Technologies. Styx dark-web monitoring, Booba Project group record (canonical database, newest record 21 September 2026). Internal collection. Cross-group legal-sector comparison: 30-day window 22 August to 21 September 2026, about 18 law-practice victims of 904 (tag plus keyword classification).
Intruvent Technologies. Booba Project Threat Actor Profile. INT-TAP-2026-BOOBAPROJECT-v1.1, 24 September 2026, TLP:CLEAR. Companion document to this guide.
Intruvent Golden CTI Database (Codex). Alias and actor search for "Booba Project" (no results); technique-to-actor counts for T1490 and T1560.001; false-positive checks for the email and onion indicators in Appendix A. Queried 24 September 2026.
MITRE ATT&CK Enterprise Matrix. Technique definitions for Section 04. attack.mitre.org.
SigmaHQ. Sigma rule repository, rules/windows/process_creation (rules listed in Appendix B). Detection Rule License 1.1. github.com/SigmaHQ/sigma.
Splunk. Security Content (ESCU) detections repository (detections listed in Appendix B, plus 7f5fb3e1 for Network_Traffic field usage). github.com/splunk/security_content.
Microsoft. Defender XDR advanced hunting schema: DeviceProcessEvents, DeviceFileEvents, DeviceLogonEvents. learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables.
Microsoft. Azure Monitor Logs table reference: AADUserRiskEvents, SigninLogs, SecurityEvent, CommonSecurityLog, OfficeActivity. learn.microsoft.com/en-us/azure/azure-monitor/reference/tables.
Microsoft. What are risk detections? Microsoft Entra ID Protection (leakedCredentials; mass access to sensitive files). learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks.
Microsoft. Build queries or rules with watchlists. Microsoft Sentinel (_GetWatchlist, SearchKey). learn.microsoft.com/en-us/azure/sentinel/watchlists-queries.
Microsoft. 5145(S, F) A network share object was checked to see whether client can be granted desired access. Audit Detailed File Share. learn.microsoft.com (event 5145).
Microsoft. Audit log activities. Microsoft Purview (FileDownloaded). learn.microsoft.com/en-us/purview/audit-log-activities.

·VERSION HISTORY & CLASSIFICATION

v1.0.1 · 24 SEP 2026

v1.0.1 (24 SEP 2026): Victim names removed; victim listings replaced with sector aggregates per Intruvent public-reporting policy.

v1.0 · 24 SEP 2026

Initial release. Seven behavioral hunt modules; 18 queries (11 KQL, 4 SPL, 3 Sigma), all untested in the Intruvent lab. Companion to INT-TAP-2026-BOOBAPROJECT-v1.1.

CLASSIFICATION

TLP:CLEAR. May be shared without restriction. Reproduced SigmaHQ rules remain subject to the Detection Rule License 1.1 and must keep their attribution.

OPEN ITEMS

Lab validation of all 18 queries against Defender XDR, Sentinel, and Splunk test data. Product-specific DMS log sources for Module 03 pending vendor documentation review. Update indicators and modules if an incident report or malware analysis for Booba Project is published.

Download the Booba Project Threat Hunting Guide

INT-THG-2026-BOOBAPROJECT v1.0, TLP:CLEAR

Download PDF (free)