American Lending Center Breach: Detecting and Containing Encryption-Based Ransomware

---
title: Potential Ransomware Prep - VSS Deletion
id: a0b1c2d3-e4f5-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to delete Volume Shadow Copies, a common precursor to encryption to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
  condition: selection
falsepositives:
  - System administration tasks (rare)
level: high
---
title: Suspicious PowerShell Encoded Command Pattern
id: b1c2d3e4-f5a6-5b6c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell usage with heavily encoded commands, often used to obfuscate ransomware loaders.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Legitimate scripting utilizing encoding
level: medium
---
title: Mass File Encryption via System Processes
id: c2d3e4f5-a6b7-6c7d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects abnormal file modification patterns typical of ransomware via suspicious child processes.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe'
      - '\services.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
    CommandLine|contains:
      - ' -c '
      - ' /c '
  condition: selection
falsepositives:
  - Legitimate software updates
level: high

let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Look for typical ransomware prep tools
| where FileName in~ ("vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "schtasks.exe", "icacls.exe")
| extend ToolType = case(
    FileName == "vssadmin.exe", "VSS_Manipulation",
    FileName == "wbadmin.exe", "Backup_Deletion",
    FileName == "bcdedit.exe", "Recovery_Modification",
    "Other_Tool"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ToolType, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for ransomware notes and suspicious executables in user profiles
SELECT 
  FullPath, 
  Size, 
  Mtime, 
  Mode.String AS Mode
FROM glob(globs="C:/Users/*/*.locked")
LIMIT 50

-- Additionally, hunt for recently created executables in AppData (common persistence location)
SELECT 
  FullPath, 
  Size, 
  Mtime, 
  Btime
FROM glob(globs="C:/Users/*/AppData/Local/*.exe")
WHERE Mtime > now() - 7*60*60*24
  OR Btime > now() - 7*60*60*24

# American Lending Center Style Incident Triage Script
# Run as Administrator

Write-Host "[+] Starting Ransomware Triage..." -ForegroundColor Cyan

# 1. Check for Shadow Copy Deletion Events (Event ID 1 from Sysmon or VSS provider)
Write-Host "[*] Checking for recent VSS deletion attempts..."
$VSSFilter = @{LogName='System'; ProviderName='VSS'; StartTime=(Get-Date).AddDays(-7); Id=12343}
try {
    $VSSEvents = Get-WinEvent -FilterHashtable $VSSFilter -ErrorAction Stop
    if ($VSSEvents) {
        Write-Host "[!] ALERT: Found $($VSSEvents.Count) VSS deletion events in the last 7 days." -ForegroundColor Red
        $VSSEvents | Select-Object TimeCreated, Message | Format-Table
    } else {
        Write-Host "[-] No recent VSS deletion events found." -ForegroundColor Green
    }
} catch { Write-Host "[-] No VSS events found." }

# 2. Check for Suspicious Scheduled Tasks (common persistence)
Write-Host "[*] Checking for suspicious scheduled tasks..."
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*.exe" -and $_.Actions.WorkingDirectory -like "$env:APPDATA*" }
if ($SuspiciousTasks) {
    Write-Host "[!] ALERT: Found tasks running from AppData." -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Actions
} else {
    Write-Host "[-] No suspicious tasks found." -ForegroundColor Green
}

# 3. Audit Hidden Users (often created for persistence)
Write-Host "[*] Checking for hidden local users..."
$LocalUsers = Get-LocalUser | Where-Object { $_.Enabled -eq $true }
$HiddenUsers = $LocalUsers | Where-Object { $_.SID.Value -notmatch "-500" -and $_.SID.Value -notmatch "-501" }
if ($HiddenUsers) {
    Write-Host "[!] ALERT: Found non-standard enabled users." -ForegroundColor Yellow
    $HiddenUsers | Select-Object Name, SID, LastLogon
} else {
    Write-Host "[-] No unexpected users found." -ForegroundColor Green
}

Write-Host "[+] Triage Complete. Review alerts." -ForegroundColor Cyan