---
title: BARRACUDA - Pre-Encryption Shadow Copy Tampering
id: 8f3a1c2e-7b4d-4e9a-b6c1-2d5e8f0a9b31
status: experimental
description: Detects deletion or modification of Volume Shadow Copies via vssadmin, wmic, or bcdedit - a hallmark pre-encryption anti-recovery step observed across double-extortion crews including BARRACUDA.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete shadows all'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance scripts
  - IT storage reclamation tasks
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: BARRACUDA - PsExec or WMI Remote Service Execution for Lateral Movement
id: 4b7d9e1a-2c6f-4a8b-9d3e-5f1a7c0e2b44
status: experimental
description: Detects remote execution patterns consistent with BARRACUDA-style lateral movement - PsExec service installation, WMIC remote process creation, or ADMIN$/IPC$ based tool deployment from a non-administrative host.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\psexec64.exe'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'process call create'
      - '/node:'
  selection_svc:
    CommandLine|contains:
      - 'ADMIN$'
      - 'IPC$'
    ParentImage|endswith: '\services.exe'
  condition: selection_psexec or selection_wmic or selection_svc
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) - baseline known deployment hosts and exclude
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: BARRACUDA - Suspect Data Staging and Archive Creation Before Exfiltration
id: 9c2e5f7b-1d4a-4b8c-a3e6-7f0d2b9c4e58
status: experimental
description: Detects mass archive creation with compression utilities to staging directories, plus common exfiltration tooling (rclone, winscp) - the pre-leak data staging phase characteristic of double-extortion operations.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_archiver:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
  selection_archiver_cmd:
    CommandLine|contains:
      - ' -p'
      - '.rar'
      - '.7z'
      - 'a -t7z'
  selection_exfil_tool:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
      - '\megacmd.exe'
  condition: (selection_archiver and selection_archiver_cmd) or selection_exfil_tool
falsepositives:
  - Legitimate backup compression jobs
  - Developer build packaging - restrict alerting to non-build, non-backup hosts
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567

// BARRACUDA pre-ransomware staging hunt - Microsoft Sentinel
// Hunts for the compressed 72-hour window before detonation: new service installs,
// remote execution, archive tooling, shadow copy tampering, and bulk file access
// on the same host within a rolling window.
let Lookback = 7d;
let StagingWindow = 72h;
let SuspiciousProcs = dynamic(["vssadmin.exe","bcdedit.exe","rar.exe","7z.exe","7za.exe","rclone.exe","winscp.exe","PSEXESVC.exe","wmic.exe","psexec.exe"]);
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousProcs)
    | project DeviceName, ProcTime=TimeGenerated, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let NewServices =
    Event
    | where TimeGenerated > ago(Lookback)
    | where EventID == 7045
    | extend ServiceName = tostring(split(EventData, "<")[0])
    | project DeviceName=Computer, SvcTime=TimeGenerated, ServiceName, EventData;
let BulkFileAccess =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "FileCreated"
    | where FileName endswith ".rar" or FileName endswith ".7z" or FileName endswith ".zip"
    | summarize ArchiveCount = count(), ArchiveNames = make_set(FileName, 10) by DeviceName, bin(TimeGenerated, 1h)
    | where ArchiveCount >= 5;
ProcEvents
| join kind=inner (NewServices) on DeviceName
| where ProcTime between (SvcTime .. SvcTime + StagingWindow)
| join kind=leftouter (BulkFileAccess) on DeviceName
| summarize
    SuspiciousProcessCount = count(),
    ProcessesSeen = make_set(FileName, 20),
    Commands = make_set(ProcessCommandLine, 10),
    NewServicesInstalled = make_set(ServiceName, 10),
    TotalArchiveBurst = sum(ArchiveCount)
    by DeviceName, AccountName, bin(ProcTime, 1d)
| where SuspiciousProcessCount >= 2
| order by SuspiciousProcessCount desc;
// Escalate any host with 3+ distinct suspicious processes AND a new service AND archive bursts.

# BARRACUDA Rapid Triage Script - run on suspect hosts or fleet-wide via your RMM/EDR shell
# Checks: RDP exposure, shadow copy health, scheduled tasks added in last 7 days,
# suspicious new services, and known staging/exfil tooling presence.
# Classification: TLP:CLEAR | Security Arsenal | 2026-09-27

Write-Host "=== BARRACUDA Rapid Triage - $(Get-Date -Format 'yyyy-MM-dd HH:mm') ===" -ForegroundColor Cyan

# 1. RDP exposure check
Write-Host "`n[1] RDP Exposure" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
if ($rdpEnabled -eq 0) {
    Write-Host "  [!] RDP ENABLED. NLA: $(if($nla -eq 1){'ON (good)'}else{'OFF - RISK'})" -ForegroundColor Red
    Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort | Format-Table
} else { Write-Host "  [OK] RDP disabled." -ForegroundColor Green }

# 2. Volume Shadow Copy health (anti-recovery tampering check)
Write-Host "`n[2] Volume Shadow Copies" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | Select-Object DeviceObject, InstallDate, @{N='AgeHours';E={[math]::Round(((Get-Date)-$_.InstallDate).TotalHours,1)}} | Format-Table
    $recent = $shadows | Where-Object { $_.InstallDate -gt (Get-Date).AddDays(-1) }
    if (-not $recent) { Write-Host "  [!] No shadow copies newer than 24h - verify backup cadence has not been tampered with." -ForegroundColor Red }
} else { Write-Host "  [!] ZERO shadow copies present - potential T1490 tampering. Investigate." -ForegroundColor Red }

# 3. Scheduled tasks created/modified in last 7 days
Write-Host "`n[3] Scheduled Tasks (last 7 days)" -ForegroundColor Yellow
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$info.LastRunTime }
} | Where-Object { $_.Path -notlike '\Microsoft*' -and $_.LastRun -gt (Get-Date).AddDays(-7) } | Format-Table -AutoSize

# 4. New services in last 7 days (PsExec-style lateral movement artifact)
Write-Host "`n[4] Services Installed in Last 7 Days (Event 7045)" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='Binary';E={$_.Properties[1].Value}} | Format-Table -AutoSize

# 5. Known staging/exfil tooling sweep
Write-Host "`n[5] Staging/Exfil Tooling Sweep" -ForegroundColor Yellow
$tools = @('rclone.exe','winscp.exe','megacmd.exe','PSEXESVC.exe','7za.exe')
foreach ($t in $tools) {
    $found = Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Filter $t -Recurse -ErrorAction SilentlyContinue -Depth 4
    if ($found) { $found | ForEach-Object { Write-Host "  [!] FOUND: $($_.FullName) (Modified: $($_.LastWriteTime))" -ForegroundColor Red } }
}
Write-Host "`n=== Triage complete. Escalate any [!] findings to IR immediately. ===" -ForegroundColor Cyan