ANSSI 2025 Report: Encryption-Based Attacks Targeting French SMBs — Defense and Detection Guide

---
title: Potential Ransomware Activity - VSS Shadow Copy Deletion
id: 8a8b8c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin or wmic, a common precursor to ransomware encryption to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2025/04/01
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: 1 of selection_*
falsepositives:
  - System administrators manually managing disk space (rare)
level: high
---
title: Potential Data Wiping via Cipher.exe
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the use of cipher.exe to overwrite deleted data, often used by ransomware operators to make forensic recovery impossible.
references:
  - https://attack.mitre.org/techniques/T1485/
author: Security Arsenal
date: 2025/04/01
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\cipher.exe'
    CommandLine|contains: '/w'
  condition: selection
falsepositives:
  - Legitimate secure disk wiping operations
level: high
---
title: Mass File Encryption via PowerShell
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects PowerShell scripts attempting to encrypt files using .NET cryptography APIs, indicative of custom ransomware scripts.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2025/04/01
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'System.Security.Cryptography.AesManaged'
      - 'System.Security.Cryptography.RijndaelManaged'
      - 'FileInfo.Extension'
  condition: selection
falsepositives:
  - Legitimate backup scripts or file management tools (verify source)
level: medium

// Hunt for Shadow Copy Deletion and suspicious process behavior
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "cipher.exe")
| extend ProcessCommand = ProcessCommandLine
| where ProcessCommand contains_any ("delete shadows", "shadowcopy delete", "/w")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommand
| order by Timestamp desc

-- Hunt for ransomware precursor processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "vssadmin.exe" 
   OR Name =~ "wmic.exe"
   OR Name =~ "cipher.exe"
   OR Name =~ "powershell.exe"

-- Supplement with file system glob for common ransomware notes/extensions
SELECT FullPath, Size, Mtime
FROM glob(globs="C:\\Users\\\\*\\*.encrypted")
LIMIT 50

# Audit RDP and VSS Security Posture
Write-Host "[+] Starting Security Audit for Ransomware Prerequisites..." -ForegroundColor Cyan

# 1. Check if RDP is enabled
$rdpProperty = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -ErrorAction SilentlyContinue
if ($rdpProperty.fDenyTSConnections -eq 0) {
    Write-Host "[!] WARNING: Remote Desktop (RDP) is ENABLED." -ForegroundColor Red
    Write-Host "    Recommendation: Disable RDP or enforce strict VPN/MFA access." -ForegroundColor Yellow
} else {
    Write-Host "[+] PASS: RDP is Disabled." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Service (VSS) Status
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne 'Running') {
    Write-Host "[!] WARNING: Volume Shadow Copy Service is not running." -ForegroundColor Red
    Write-Host "    Attempting to start VSS..." -ForegroundColor Yellow
    Start-Service VSS -ErrorAction SilentlyContinue
} else {
    Write-Host "[+] PASS: VSS Service is Running." -ForegroundColor Green
}

# 3. Check for recent Shadow Copies (Ensure backups exist)
try {
    $shadows = vssadmin list shadows 2>&1
    if ($shadows -match "No shadow copies found") {
        Write-Host "[!] WARNING: No Volume Shadow Copies found. System is vulnerable to permanent data loss." -ForegroundColor Red
    } else {
        Write-Host "[+] PASS: Existing Shadow Copies detected." -ForegroundColor Green
    }
} catch {
    Write-Host "[!] Could not query VSS state." -ForegroundColor Red
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan