Conti Ransomware TTPs: Active Defense and Incident Response Playbook

---
title: Conti Style Shadow Copy Deletion
id: 85c9b9e0-8c6e-4b0b-8f9e-1b2b3d4e5f6g
status: experimental
description: Detects the deletion of Volume Shadow Copies, a common Conti tactic to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
  condition: selection
falsepositives:
  - System administrator maintenance (rare)
level: critical
---
title: Potential Rclone Exfiltration Tool
id: 92f1c8d0-7e5a-3c6a-9e8f-0a1b2c3d4e5f
status: experimental
description: Detects the use of rclone, a tool frequently used by ransomware actors for data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
    CommandLine|contains:
      - 'config create'
      - 'copy'
      - 'sync'
  condition: selection
falsepositives:
  - Legitimate backup operations using rclone
level: high
---
title: PowerShell AMSI Bypass via Reflection
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects common PowerShell patterns used by Conti loaders to bypass AMSI.
references:
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
    CommandLine|contains:
      - 'System.Management.Automation.AmsiUtils'
      - 'amsiInitFailed'
  condition: selection
falsepositives:
  - Rare, usually indicates malicious intent
level: critical

let DiscoveryCommands = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("net view", "net group", "net computer", "qwinsta")
| project DeviceId, Timestamp, FileName, ProcessCommandLine;
let DestructiveCommands = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "wbadmin delete")
| project DeviceId, Timestamp, FileName, ProcessCommandLine;
DiscoveryCommands
| join (DestructiveCommands) on DeviceId
| where DestructiveCommands_Timestamp between (DiscoveryCommands_Timestamp .. 30m)
| project DeviceId, Discovery_Timestamp=DiscoveryCommands_Timestamp, Destructive_Timestamp=DestructiveCommands_Timestamp, Discovery_Command=DiscoveryCommands_ProcessCommandLine, Destructive_Command=DestructiveCommands_ProcessCommandLine
| order by Destructive_Timestamp desc

-- Hunt for suspicious binaries in common drop locations
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs="C:\Users\Public\*.exe", root="/")
WHERE Mtime > now() - 7d
  AND Name NOT IN ("desktop.ini", "laptops.ini")
UNION
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs="C:\Users\*\AppData\Local\Temp\*.exe", root="/")
WHERE Mtime > now() - 1h
  AND Name =~ '^[a-zA-Z0-9]{8,}\.(exe|dll)$'

# 1. Stop and disable common services abused by ransomware
ServicesToStop = @("Schedule", "WSearch", "DHCP", "DNS") # Example, adjust based on environment
Write-Host "Checking for common persistence mechanisms..."

# 2. Audit and Restrict VSS Administration
Write-Host "Restricting VSS Administration to Local System only..."
$vssKey = "HKLM:\SYSTEM\CurrentControlSet\Services\VSS"
$vssACL = Get-Acl $vssKey
$ar = New-Object System.Security.AccessControl.RegistryAccessRule("NT AUTHORITY\SYSTEM","FullControl","Allow")
$vssACL.SetAccessRule($ar)
Set-Acl $vssKey $vssACL

# 3. Enable Network Level Authentication (NLA) for RDP
Write-Host "Enabling NLA for RDP..."
$NLAPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
Set-ItemProperty -Path $NLAPath -Name "UserAuthentication" -Value 1 -Force

# 4. Disable WMI from non-admins
Write-Host "Restricting WMI remote access..."
Set-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\WBEM\CIMOM" -Name "EnableRemoteWMI" -Value 0 -Force

# 5. Check for Suspicious Scheduled Tasks
Write-Host "Auditing Scheduled Tasks created in the last 24 hours..."
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-1)} | Select-Object TaskName, Author, Date

Write-Host "Remediation actions completed."