Gunra Ransomware: CISA AA26-222a Detection, Hunting, and Hardening Guide for Defenders

---
title: Shadow Copy Deletion via Command-Line Utility
description: Detects deletion of Volume Shadow Copies using vssadmin, wmic, or PowerShell — a hallmark anti-recovery step executed immediately before ransomware detonation, including Gunra deployments per CISA AA26-222a.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/08/11
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\diskshadow.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Delete Shadows'
      - 'Win32_ShadowCopy'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup administrators resizing shadowstorage (investigate context)
  - Some backup software interacting with VSS during maintenance windows
level: high
---
title: Suspicious Archive Staging for Data Exfiltration
description: Detects creation of large compressed archives in user or temp directories using common archiving tools — consistent with ransomware affiliate data staging before double-extortion exfiltration, as described in CISA AA26-222a for Gunra.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
  - https://attack.mitre.org/techniques/T1560/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/08/11
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' -a '
      - ' a '
      - '-p'
  selection_paths:
    CommandLine|contains:
      - '\Users\'
      - '\Temp\'
      - '\ProgramData\'
      - 'C:\\'
  condition: selection_img and selection_cli and selection_paths
falsepositives:
  - IT administrators archiving data for migrations
  - Automated backup scripts using 7-Zip
level: medium
---
title: Ransom Note Deployment via Command Shell
description: Detects mass creation of ransom-note-style text or HTML files through cmd or PowerShell loops — a behavioral indicator of ransomware note deployment observed in Gunra and comparable RaaS operations.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/08/11
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'readme'
      - 'decrypt'
      - 'recover'
      - 'restore_files'
      - '.hta'
  selection_loop:
    CommandLine|contains:
      - 'for /r'
      - 'foreach'
      - 'Get-ChildItem'
      - 'echo'
  condition: selection_shell and selection_cli and selection_loop
falsepositives:
  - Administrators scripting documentation distribution (rare)
level: high

let antiRecovery = dynamic(["delete shadows", "shadowcopy delete", "resize shadowstorage", "bcdedit", "recoveryenabled no", "wbadmin delete catalog", "Win32_ShadowCopy"]);
let stagingTools = dynamic(["rar.exe", "7z.exe", "7za.exe", "megacmd", "rclone", "FileZilla"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| extend CmdLine = tolower(ProcessCommandLine), File = tolower(FileName)
| where (CmdLine has_any (antiRecovery))
     or (File has_any (stagingTools) and CmdLine has_any (" -p", " a ", " -a ", "sync", "copy"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, FolderPath
| order by TimeGenerated desc

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceAction =~ "Allow" or isempty(DeviceAction)
| summarize TotalBytes = sum(tolong(SentBytes)), Connections = count() by SourceIP, DestinationIP, DestinationPort
| where TotalBytes > 500000000
| where DestinationPort in (443, 22, 21, 8080, 8443)
| order by TotalBytes desc

-- Gunra pre-impact hunt: archiving tools, shadow copy tampering, large egress
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy|rclone|megacmd|7z.*(-p| a )|rar.* a )'
   OR Name =~ '(?i)(vssadmin|rclone|megacmd)'

-- Endpoint netstat: flag processes holding high-count outbound 443/22 connections
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort in (443, 22, 21, 8443)
  AND Status =~ 'ESTAB'
  AND NOT RemoteAddress =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'

# Gunra Ransomware Readiness Audit — Security Arsenal
# Run as Administrator. Outputs PASS/FAIL per control.

$results = @()

# 1. VSS protection: confirm shadow copies exist and shadowstorage is sized
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{ Control = 'Volume Shadow Copies present'; Status = if ($shadows) { 'PASS' } else { 'FAIL - No shadow copies found' } }

# 2. Attack Surface Reduction: check ransomware-relevant ASR rules
$asr = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids -ErrorAction SilentlyContinue
$asrActions = (Get-MpPreference).AttackSurfaceReductionRules_Actions
$needed = @('d4f940ab-401b-4efc-aadc-ad5f3c50688a','56a863a9-875e-4185-98a7-b882c64b5ce5','7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c')
$enabled = if ($asr) { $needed | Where-Object { $asr -contains $_ } } else { @() }
$results += [PSCustomObject]@{ Control = 'ASR rules (Office abuse, LSASS, ransomware)'; Status = if ($enabled.Count -ge 2) { 'PASS' } else { 'FAIL - Enable ASR rules via GPO/Intune' } }

# 3. Tamper Protection status
$tp = (Get-MpComputerStatus).IsTamperProtected
$results += [PSCustomObject]@{ Control = 'Defender Tamper Protection'; Status = if ($tp) { 'PASS' } else { 'FAIL - Enable via Intune/Security portal' } }

# 4. Real-time protection and cloud-delivered protection
$rt = (Get-MpComputerStatus).RealTimeProtectionEnabled
$results += [PSCustomObject]@{ Control = 'Defender Real-Time Protection'; Status = if ($rt) { 'PASS' } else { 'FAIL' } }

# 5. SMBv1 disabled (legacy lateral movement path)
$smb1 = (Get-SmbServerConfiguration).EnableSMB1Protocol
$results += [PSCustomObject]@{ Control = 'SMBv1 disabled'; Status = if (-not $smb1) { 'PASS' } else { 'FAIL - Disable-SmbServerConfiguration / Set-SmbServerConfiguration -EnableSMB1Protocol $false' } }

# 6. RDP exposure check: NLA required
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$results += [PSCustomObject]@{ Control = 'RDP Network Level Authentication'; Status = if ($nla -eq 1) { 'PASS' } else { 'WARN - Require NLA or restrict RDP' } }

# 7. Local admin password hygiene: LAPS present
$laps = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS' -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{ Control = 'Windows LAPS configured'; Status = if ($laps) { 'PASS' } else { 'FAIL - Deploy Windows LAPS' } }

$results | Format-Table -AutoSize
$failCount = ($results | Where-Object { $_.Status -like 'FAIL*' }).Count
Write-Host "`nAudit complete. $failCount control(s) failing. Remediate before the next shift." -ForegroundColor (if ($failCount -gt 0) { 'Red' } else { 'Green' })