DIREWOLF Ransomware Gang: 10 Victims Posted in 24 Hours — Cross-Sector Campaign Analysis, Initial Access CVEs & Detection Rules

---
title: Direwolf Ransomware - Shadow Copy Deletion Pre-Encryption
id: 8f3a2d1e-d1r3-4w0l-f001-aa11bb22cc01
status: experimental
description: Detects Volume Shadow Copy deletion and backup catalog tampering consistent with Direwolf pre-encryption staging behavior
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
level: high
date: 2026/08/11
modified: 2026/08/11
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'delete shadows /all'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance scripts
  - System administrators running storage remediation
references:
  - https://securityarsenal.com/darkside
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
tags:
  - attack.impact
  - attack.t1490
---
title: Direwolf Ransomware - Remote Access Tool Suspicious Child Process
id: 8f3a2d1e-d1r3-4w0l-f002-aa11bb22cc02
status: experimental
description: Detects suspicious child processes spawned by ConnectWise ScreenConnect and other RMM tools commonly abused by Direwolf affiliates for hands-on deployment (CVE-2024-1708 post-exploitation pattern)
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
level: high
date: 2026/08/11
modified: 2026/08/11
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer_Service.exe'
      - '\ninja-rmm.exe'
      - '\level.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_suspicious:
    CommandLine|contains:
      - '-enc '
      - '-e '
      - 'downloadstring'
      - 'invoke-webrequest'
      - 'iex '
      - 'http://'
      - 'https://'
      - '-urlcache'
  condition: selection_parent and selection_child and selection_suspicious
falsepositives:
  - Legitimate MSP automation scripts
  - RMM-deployed patching
references:
  - https://securityarsenal.com/darkside
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
tags:
  - attack.command-and-control
  - attack.t1219
  - attack.t1059
---
title: Direwolf Ransomware - Lateral Movement PsExec WMI Service Install
id: 8f3a2d1e-d1r3-4w0l-f003-aa11bb22cc03
status: experimental
description: Detects remote service installation and PsExec/WMI-style lateral movement patterns observed in Direwolf intrusions prior to mass encryption and data staging
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  service: security
level: high
date: 2026/08/11
modified: 2026/08/11
detection:
  selection_event:
    EventID: 7045
  selection_service:
    ServiceFileName|contains:
      - 'PSEXESVC'
      - '\\ADMIN$\\'
      - '\\C$\\Windows\\Temp\\'
      - '\\Users\\Public\\'
      - '%COMSPEC%'
      - 'powershell'
  filter_known:
    ServiceName|contains:
      - 'SCCM'
      - 'BigFix'
  condition: selection_event and selection_service and not filter_known
falsepositives:
  - Enterprise software distribution tools
  - Legitimate administrative PsExec usage
references:
  - https://securityarsenal.com/darkside
fields:
  - ServiceName
  - ServiceFileName
  - ComputerName
  - AccountName
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1021.002

let lookback = 7d;
let ShadowCopyTamper =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage",
        "recoveryenabled no", "ignoreallfailures", "delete catalog")
    | summarize ShadowEvents = count(), ShadowCmds = make_set(ProcessCommandLine, 5) by DeviceName, bin(Timestamp, 1h);
let ArchiveStaging =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" a ", " -p", "hp", ".rar", ".7z", ".zip")
    | summarize ArchiveEvents = count(), ArchiveCmds = make_set(ProcessCommandLine, 5) by DeviceName, bin(Timestamp, 1h);
let RemoteServiceInstall =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045
    | where ServiceFileName has_any ("PSEXESVC", "ADMIN$", "\\Temp\\", "\\Public\\", "powershell")
    | summarize ServiceInstalls = count(), Services = make_set(ServiceName, 10) by Computer, bin(TimeGenerated, 1h);
let ExfilIndicators =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemoteUrl has_any ("mega.nz", "mega.io", "transfer.sh", "file.io", "anonfiles", "gofile.io",
        "temp.sh", "wetransfer", "dropbox", "rclone")
       or (InitiatingProcessFileName in~ ("rclone.exe", "megacmd.exe", "curl.exe") and RemotePort in (443, 21, 22))
    | summarize ExfilEvents = count(), ExfilDests = make_set(RemoteUrl, 10), ExfilProcs = make_set(InitiatingProcessFileName, 5) by DeviceName, bin(Timestamp, 1h);
ShadowCopyTamper
| join kind=fullouter ArchiveStaging on DeviceName, Timestamp
| join kind=fullouter RemoteServiceInstall on $left.DeviceName == $right.Computer
| join kind=fullouter ExfilIndicators on DeviceName, Timestamp
| extend HostRiskScore = toint(column_ifexists("ShadowEvents", 0)) * 40
    + toint(column_ifexists("ArchiveEvents", 0)) * 20
    + toint(column_ifexists("ServiceInstalls", 0)) * 25
    + toint(column_ifexists("ExfilEvents", 0)) * 30
| where HostRiskScore > 0
| project Timestamp = coalesce(Timestamp, Timestamp1, TimeGenerated, Timestamp2),
    DeviceName = coalesce(DeviceName, Computer, DeviceName1),
    HostRiskScore, ShadowEvents, ArchiveEvents, ServiceInstalls, ExfilEvents,
    ShadowCmds, ArchiveCmds, Services, ExfilDests
| order by HostRiskScore desc

# Direwolf Rapid Triage Script - Security Arsenal Threat Intelligence
# Run elevated. Outputs to C:\IR-Triage\direwolf-triage-<host>-<timestamp>.txt
$out = "C:\IR-Triage"; New-Item -ItemType Directory -Force -Path $out | Out-Null
$report = "$out\direwolf-triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
"=== DIREWOLF PRE-DETONATION TRIAGE - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $report

"`n[1] SCHEDULED TASKS CREATED/MODIFIED IN LAST 7 DAYS" | Out-File $report -Append
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Task=$_.TaskName; Path=$_.TaskPath; State=$_.State;
        Author=$_.Author; LastRun=$info.LastRunTime }
} | Where-Object { $_.Author -notmatch 'Microsoft' -and $_.Path -notmatch '^\\Microsoft' } |
    Format-Table -AutoSize | Out-File $report -Append

"`n[2] VOLUME SHADOW COPY STATE (empty/missing = tamper indicator)" | Out-File $report -Append
$vss = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $vss) { "!! NO SHADOW COPIES FOUND - possible vssadmin/wmic deletion !!" | Out-File $report -Append }
else { $vss | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize | Out-File $report -Append }

"`n[3] SUSPICIOUS SERVICES (PSEXESVC / temp-path binaries)" | Out-File $report -Append
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'PSEXESVC|\\Temp\\|\\Public\\|ADMIN\$' -and $_.State -eq 'Running'
} | Select-Object Name, DisplayName, PathName, StartName | Format-List | Out-File $report -Append

"`n[4] RDP EXPOSURE CHECK" | Out-File $report -Append
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
"RDP Enabled: $rdpEnabled | NLA Required: $($nla -eq 1)" | Out-File $report -Append
$rdpListen = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdpListen) { "!! RDP LISTENING - verify it is not internet-exposed !!" | Out-File $report -Append }

"`n[5] RECENT ARCHIVE / EXFIL TOOL ARTIFACTS (last 7 days)" | Out-File $report -Append
Get-ChildItem -Path C:\ -Include *.rar,*.7z,rclone.exe,megacmd.exe -Recurse -ErrorAction SilentlyContinue -Force |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.FullName -notmatch 'Windows\\WinSxS' } |
    Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize | Out-File $report -Append

"`n[6] FAILED LOGON SPIKE (brute force indicator - Event 4625, last 24h)" | Out-File $report -Append
$failed = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
"Failed logons (24h): $($failed.Count)" | Out-File $report -Append
$failed | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10 Count, Name |
    Format-Table -AutoSize | Out-File $report -Append

"`nTriage complete: $report"