AURORA Ransomware Gang: 3 New Victims Posted — Sector Targeting Analysis & Detection Rules

---
title: AURORA Ransomware - Volume Shadow Copy Deletion via LOLBins
id: 9f2a1c4e-aur0-0001-a001-000000000001
status: production
description: Detects deletion of Volume Shadow Copies using vssadmin, wmic, bcdedit, or diskshadow - a consistent AURORA pre-encryption behavior observed immediately before detonation.
author: Security Arsenal Threat Intel
date: 2026/08/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: critical
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup administrators modifying shadow storage
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
---
title: AURORA Ransomware - PsExec or WMI Remote Execution for Payload Staging
id: 9f2a1c4e-aur0-0002-a001-000000000002
status: production
description: Detects remote service creation and WMI process execution patterns consistent with AURORA affiliate lateral movement and ransomware payload distribution across hosts.
author: Security Arsenal Threat Intel
date: 2026/08/19
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
    CommandLine|contains:
      - '\\'
  selection_wmi:
    ParentImage|endswith:
      - '\wmiprvse.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  selection_svc:
    CommandLine|contains:
      - 'sc.exe'
      - ' create '
      - ' binpath'
  condition: selection_psexec or selection_wmi or selection_svc
falsepositives:
  - Enterprise software deployment tools (SCCM, PDQ) - whitelist known admin hosts
fields:
  - Image
  - ParentImage
  - CommandLine
  - Computer
  - User
---
title: AURORA Ransomware - Check Point VPN Exploitation Follow-on Auth Anomaly
id: 9f2a1c4e-aur0-0003-a001-000000000003
status: production
description: Detects suspicious authentication patterns following potential CVE-2026-50751 exploitation - VPN logons from atypical geographies/hosts immediately followed by internal RDP or SMB session establishment.
author: Security Arsenal Threat Intel
date: 2026/08/19
logsource:
  product: windows
  service: security
level: high
detection:
  selection_logon:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_known:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_logon and not filter_known
timeframe: 15m
falsepositives:
  - Legitimate remote workforce VPN usage - baseline per-user source geographies
fields:
  - TargetUserName
  - IpAddress
  - WorkstationName
  - LogonType

// AURORA pre-encryption staging hunt: archive creation + remote exec + shadow copy tampering
let Lookback = 7d;
let StagingProcs = dynamic(["rar.exe", "7z.exe", "7za.exe", "winrar.exe", "makecab.exe", "robocopy.exe"]);
let SuspiciousDest = dynamic(["\\temp\\", "\\programdata\\", "\\users\\public\\", "\\perflogs\\"]);
let Staging = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ (StagingProcs)
    | where ProcessCommandLine has_any (SuspiciousDest) or ProcessCommandLine has " -p" // password-protected archives
    | summarize ArchiveOps = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
        CmdLines = make_set(ProcessCommandLine, 5) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h);
let RemoteExec = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName =~ "wmiprvse.exe" or FileName has_any ("psexec", "psexesvc", "paexec")
    | project RemoteTime = Timestamp, DeviceName, RemoteCmd = ProcessCommandLine, RemoteUser = InitiatingProcessAccountName;
let ShadowTamper = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "ignoreallfailures")
    | project ShadowTime = Timestamp, DeviceName, ShadowCmd = ProcessCommandLine;
Staging
| join kind=leftouter RemoteExec on DeviceName
| join kind=leftouter ShadowTamper on DeviceName
| extend RiskScore = (iff(isnotempty(RemoteTime), 40, 0)) + (iff(isnotempty(ShadowTime), 60, 0)) + (iff(ArchiveOps > 10, 20, 0))
| where RiskScore >= 40
| project DeviceName, InitiatingProcessAccountName, FirstSeen, LastSeen, ArchiveOps, RiskScore, RemoteCmd, ShadowCmd
| order by RiskScore desc, LastSeen desc

# AURORA Rapid Triage Script - Security Arsenal IR
# Run elevated on suspect hosts. Outputs to C:\IR-Triage\aurora_triage_<hostname>.txt

$out = "C:\IR-Triage"
New-Item -ItemType Directory -Path $out -Force | Out-Null
$report = Join-Path $out "aurora_triage_$env:COMPUTERNAME.txt"

"=== AURORA RAPID TRIAGE - $env:COMPUTERNAME - $(Get-Date -Format o) ===" | Out-File $report

"`n[1] SCHEDULED TASKS CREATED/MODIFIED IN LAST 7 DAYS" | Out-File $report -Append
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; LastRun=$info.LastRunTime; Author=$_.Author }
} | Where-Object { $_.Path -notlike "\Microsoft*" } | Format-Table -AutoSize | Out-File $report -Append

"`n[2] VOLUME SHADOW COPY STATUS (AURORA deletes these pre-encryption)" | Out-File $report -Append
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize | Out-File $report -Append }
else { "!!! NO SHADOW COPIES PRESENT - POSSIBLE TAMPERING !!!" | Out-File $report -Append }
vssadmin list shadows 2>&1 | Out-File $report -Append

"`n[3] BCDEDIT RECOVERY CONFIG (AURORA disables recovery)" | Out-File $report -Append
bcdedit /enum {current} 2>&1 | Select-String -Pattern "recoveryenabled|bootstatuspolicy" | Out-File $report -Append

"`n[4] RDP EXPOSURE CHECK" | Out-File $report -Append
$rdp = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -ErrorAction SilentlyContinue
$port = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -ErrorAction SilentlyContinue
"RDP Disabled flag: $($rdp.fDenyTSConnections)  (0 = RDP ENABLED)" | Out-File $report -Append
"RDP Port: $($port.PortNumber)" | Out-File $report -Append
Get-NetTCPConnection -State Listen -LocalPort $($port.PortNumber) -ErrorAction SilentlyContinue | Format-Table -AutoSize | Out-File $report -Append

"`n[5] LOCAL ADMIN ACCOUNTS CREATED IN LAST 14 DAYS" | Out-File $report -Append
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $u = Get-LocalUser $_.Name.Split('\')[-1] -ErrorAction Stop
        if ($u.PasswordLastSet -gt (Get-Date).AddDays(-14) -or $null -eq $u.LastLogon) {
            [PSCustomObject]@{ Name=$u.Name; Created=$u.PasswordLastSet; LastLogon=$u.LastLogon; Enabled=$u.Enabled }
        }
    } catch {}
} | Format-Table -AutoSize | Out-File $report -Append

"`n[6] RECENT EXECUTABLES IN STAGING DIRECTORIES (7 days)" | Out-File $report -Append
Get-ChildItem "C:\ProgramData","C:\Users\Public","C:\Windows\Temp" -Recurse -Include *.exe,*.dll,*.ps1,*.bat -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
    Select-Object FullName, CreationTime, Length | Format-Table -AutoSize | Out-File $report -Append

"`n[7] LARGE ARCHIVE FILES (EXFIL STAGING) - >100MB, last 7 days" | Out-File $report -Append
Get-ChildItem "C:\Users\Public","C:\ProgramData" -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 100MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize | Out-File $report -Append

Write-Host "[+] Triage complete: $report"