Conti Ransomware Affiliate Pleads Guilty: Active Hunt for Conti TTPs and Defensive Mitigations

---
title: Conti Ransomware Volume Shadow Copy Deletion
id: 89d3c8e1-5c2a-4e1a-b9e3-6a1c2f3d4e5a
status: experimental
description: Detects the deletion of Volume Shadow Copies using vssadmin, a common precursor to Conti encryption to prevent file recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
  condition: selection
falsepositives:
  - System administration tasks (rare)
level: critical
---
title: Potential Conti Ransomware Execution via Rundll32
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious rundll32 execution patterns often associated with Conti payloads loading DLLs from non-standard paths.
references:
  - https://attack.mitre.org/techniques/T1218/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.defense_evasion
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: 
      - '.dll,'
      - 'Control_RunDLL'
    CommandLine|re: '\\[a-zA-Z0-9]{3,}\.dll\s*,[a-zA-Z0-9]+'
  filter_main:
    ParentImage|contains:
      - '\Program Files\'
      - '\System32\'
  condition: selection and not filter_main
falsepositives:
  - Legitimate application installations
level: high
---
title: Conti Service Stop Pattern
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects commands used to stop security services or databases, a behavior observed in Conti operations prior to encryption.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'stop '
      - 'net stop '
    CommandLine|contains:
      - 'sql'
      - 'msexchange'
      - 'backup'
      - 'veeam'
      - 'svc$'
  condition: selection
falsepositives:
  - Authorized maintenance windows
level: high

let TimeFrame = 1h;
let ShadowCopyDeletion = 
  DeviceProcessEvents
  | where Timestamp > ago(TimeFrame)
  | where ProcessCommandLine has "delete" and ProcessCommandLine has "shadow" 
      and (FileName == "vssadmin.exe" or FileName == "wmic.exe");
let SuspiciousExec = 
  DeviceProcessEvents
  | where Timestamp > ago(TimeFrame)
  | where FolderPath has @"\Temp\" or FolderPath has @"\AppData\Local\Temp"
  | where FileName in ("rundll32.exe", "powershell.exe", "cmd.exe")
  | project DeviceId, DeviceName, Timestamp, ProcessCommandLine, InitiatingProcessFileName;
ShadowCopyDeletion
| join kind=inner SuspiciousExec on DeviceId, Timestamp
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for Conti Ransomware Indicators
SELECT 
  OSPath,
  Mtime,
  Size,
  Mode.String
FROM glob(globs="C:\\*", root="/")
WHERE Name =~ "README.*.txt" 
   AND Mtime > now() - 24h

-- Hunt for processes manipulating shadow copies or running from temp
SELECT Pid, Name, Exe, CommandLine, StartTime
FROM pslist()
WHERE Exe =~ "vssadmin.exe" 
   OR Exe =~ "wmic.exe"
   OR (Exe =~ "rundll32.exe" AND CommandLine =~ ".dll")

# Audit and Harden RDP against Conti-style brute force
Write-Host "Auditing RDP Configuration..."
$rdpProp = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections'
if ($rdpProp.fDenyTSConnections -ne 1) {
    Write-Warning "RDP is Enabled. Disabling for security hardening."
    Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1
} else {
    Write-Host "RDP is already disabled."
}

# Ensure NLA is required (Legacy)
$nlaProp = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication'
if ($nlaProp.UserAuthentication -ne 1) {
    Write-Warning "Network Level Authentication is disabled. Enabling..."
    Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 1
}

# Check for suspicious scheduled tasks (Persistence)
Write-Host "Checking for suspicious scheduled tasks..."
Get-ScheduledTask | Where-Object {$_.Action.Execute -match "powershell|cmd|wscript" -and $_.TaskPath -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, Action