Conti Ransomware Developer Sentenced to 4 Years: Detection and Hardening Guide Against Conti-Tradecraft Successors

---
title: Ransomware Shadow Copy Deletion via Vssadmin or WMIC
id: 3f8c2a91-7e4d-4b6a-9c12-8d5e6f7a8b9c
status: experimental
description: Detects deletion of Volume Shadow Copies, a hallmark anti-recovery behavior used by Conti and successor ransomware families before encryption.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\diskshadow.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'delete shadows /all'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate storage administrators resizing shadow storage (rare on servers, investigate anyway)
level: high
---
title: Ransomware Recovery Disable via Bcdedit
id: 6b1e4d72-3a9f-4c58-b2d7-9e8f1a2c3d4e
status: experimental
description: Detects bcdedit commands disabling Windows recovery mode and ignoring boot failures, consistent with Conti and successor ransomware pre-encryption staging.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
  - attack.t1562
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection
falsepositives:
  - Rare; legitimate use is almost exclusively scripted IT provisioning
level: high
---
title: Mass Service Stop Prior to Ransomware Encryption
id: 9d2c7f45-1b8e-4a36-c5d9-4f6a7b8c9d0e
status: experimental
description: Detects net.exe or sc.exe being used to stop database, backup, or security services, matching Conti encryptor kill-list behavior executed via command line.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
  selection_action:
    CommandLine|contains:
      - 'stop'
      - 'delete'
  selection_targets:
    CommandLine|contains:
      - 'veeam'
      - 'backup'
      - 'sql'
      - 'mssql'
      - 'exchange'
      - 'sophos'
      - 'defender'
      - 'vss'
      - 'mepocs'
      - 'memtas'
  condition: selection_img and selection_action and selection_targets
falsepositives:
  - Legitimate service administration; tune by known admin accounts and maintenance windows
level: high

// Hunt for Conti-style pre-encryption staging: shadow deletion, recovery disable, and service kill-list execution
// Correlate multiple anti-recovery events per device within a short window — single events may be admin noise
let AntiRecovery = dynamic(["delete shadows", "shadowcopy delete", "recoveryenabled no", "bootstatuspolicy ignoreallfailures", "resize shadowstorage"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("vssadmin.exe", "bcdedit.exe", "wmic.exe", "diskshadow.exe", "net.exe", "net1.exe", "sc.exe")
| where ProcessCommandLine has_any (AntiRecovery)
   or (FileName in~ ("net.exe", "net1.exe", "sc.exe") and ProcessCommandLine has "stop" and ProcessCommandLine has_any ("veeam", "sql", "backup", "vss", "sophos"))
| summarize AntiRecoveryEvents = count(), Commands = make_set(ProcessCommandLine), Accounts = make_set(AccountName)
  by DeviceName, bin(TimeGenerated, 10m)
| where AntiRecoveryEvents >= 2
| sort by TimeGenerated desc

// Sentinel Syslog/CEF variant for environments forwarding Windows events via agents
let AntiRecovery = dynamic(["delete shadows", "shadowcopy delete", "recoveryenabled no", "ignoreallfailures"]);
union SecurityEvent, CommonSecurityLog, Syslog
| where TimeGenerated > ago(24h)
| where CommandLine has_any (AntiRecovery)
| project TimeGenerated, Computer, Account, CommandLine, Process
| sort by TimeGenerated desc

-- Hunt for evidence of shadow copy deletion and recovery tampering across the fleet
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|resize shadowstorage)'
   OR (Name =~ '(?i)(net|sc)\.exe' AND CommandLine =~ '(?i)stop' AND CommandLine =~ '(?i)(veeam|sql|backup|vss|sophos|defender)')

-- Sweep for recently dropped ransom notes in common user directories
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/Desktop/**/*readme*.txt', accessor='ntfs')
WHERE Mtime > now() - 86400

# Conti-tradecraft hardening verification - run elevated
# 1. Confirm VSS protection: ensure shadow copies exist and deletion would be audited
Write-Host "[*] Checking Volume Shadow Copy status..." -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { Write-Host "[+] $($shadows.Count) shadow copies present" } else { Write-Host "[-] WARNING: No shadow copies found" -ForegroundColor Red }

# 2. Verify recovery environment is enabled (ransomware disables this via bcdedit)
$bcd = bcdedit /enum {current} | Out-String
if ($bcd -match "recoveryenabled\s+No") { Write-Host "[-] WARNING: Recovery disabled - re-enable with: bcdedit /set {current} recoveryenabled yes" -ForegroundColor Red } else { Write-Host "[+] Recovery environment enabled" }

# 3. Confirm tamper protection / critical services are running
$critical = @("WinDefend", "VSS", "VeeamBackupSvc", "MSSQLSERVER")
foreach ($svc in $critical) {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s -and $s.Status -eq 'Running') { Write-Host "[+] $svc running" } elseif ($s) { Write-Host "[-] $svc is $($s.Status)" -ForegroundColor Yellow }
}

# 4. Enable process command-line auditing (required for the Sigma/KQL detections above)
$audit = auditpol /get /subcategory:"Process Creation" | Out-String
Write-Host "[*] Process Creation auditing: $audit"
$cmdLine = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue
if ($cmdLine.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name ProcessCreationIncludeCmdLine_Enabled -Value 1
    Write-Host "[+] Enabled command-line inclusion in process creation events"
}

# 5. Restrict PsExec-style lateral movement: verify ADMIN$ remote staging is monitored
Write-Host "[*] Recommendation: deploy attack surface reduction rule 'Block process creations originating from PSExec and WMI commands' (ASR rule d1e49aac-8f56-4280-b9ba-993a6d77406c)"