ICS Ransomware Surge: Detecting and Containing Encryption-Based Attacks on Industrial Control Systems

---
title: Potential OT Ransomware Preparation - Shadow Copy Deletion
id: 8a4b2c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects deletion of volume shadow copies, a common precursor to ransomware encryption to prevent recovery, executed on common OT Windows hosts.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete backup'
  filter_ot:
    ParentImage|contains:
      - '\View.exe'
      - '\Ignition'
      - '\FactoryTalk'
  condition: selection and not filter_ot
falsepositives:
  - Legitimate system maintenance by administrators
level: high
---
title: Suspicious PowerShell Execution on Engineering Workstations
id: 9b5c3d2e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects base64 encoded PowerShell execution or suspicious spawning from engineering software, often used for lateral movement in OT attacks.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc '
      - ' -encodedcommand '
      - 'FromBase64String'
  filter_legit:
    ParentImage|contains:
      - '\ServiceUI.exe'
      - '\mms.exe'
  condition: selection_img and selection_cli and not filter_legit
falsepositives:
  - Legitimate software deployment scripts
level: medium

// Hunt for ransomware precursor activity on OT endpoints
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cipher.exe", "icacls.exe", "vssadmin.exe", "wbadmin.exe", "bitsadmin.exe")
| where InitiatingProcessFileName !in~ ("services.exe", "svchost.exe", "mmc.exe")
| extend FullPath = FolderPath + "\" + FileName
| where ProcessCommandLine contains " /w" or ProcessCommandLine contains " /delete" or ProcessCommandLine contains " /deny"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| sort by Timestamp desc

-- Hunt for suspicious execution paths on OT assets
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ 'C:\\Users\\.*\\AppData\\Local\\Temp\\.*'
   OR Exe =~ 'C:\\ProgramData\\.*\\'
   OR Exe =~ 'C:\\Windows\\Temp\\.*'
   AND Name NOT IN ("chrome.exe", "firefox.exe", "iexplore.exe", "msedge.exe")

# OT Hardening Audit & Remediation Script
# Usage: .\OT-Hardening.ps1 -AuditMode $false

param(
    [bool]$AuditMode = $true
)

Write-Host "[+] Starting OT Host Hardening Audit/Remediation..." -ForegroundColor Cyan

# 1. Disable RDP if not strictly required (Common Vector)
$RDPStatus = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections").fDenyTSConnections
if ($RDPStatus -eq 0) {
    Write-Host "[!] RDP is ENABLED. Critical Risk." -ForegroundColor Red
    if (-not $AuditMode) {
        Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 1
        Write-Host "[+] RDP Disabled." -ForegroundColor Green
    }
} else {
    Write-Host "[+] RDP is Disabled." -ForegroundColor Green
}

# 2. Audit SMBv1 (WannaCry vector)
$SMB1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
if ($SMB1.EnableSMB1Protocol -eq $true) {
    Write-Host "[!] SMBv1 is ENABLED. Critical Risk." -ForegroundColor Red
    if (-not $AuditMode) {
        Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
        Write-Host "[+] SMBv1 Disabled." -ForegroundColor Green
    }
} else {
    Write-Host "[+] SMBv1 is Disabled." -ForegroundColor Green
}

# 3. Check for unusual services (Persistence mechanism)
Write-Host "[*] Checking for services running from Temp directories..."
$SuspiciousServices = Get-WmiObject Win32_Service | Where-Object { $_.PathName -like '*Temp*' -or $_.PathName -like '*AppData*' }
if ($SuspiciousServices) {
    Write-Host "[!] Found suspicious services:" -ForegroundColor Red
    $SuspiciousServices | Select-Object Name, PathName, StartMode
} else {
    Write-Host "[+] No suspicious services found." -ForegroundColor Green
}

Write-Host "[*] Script Complete. Review Audit findings." -ForegroundColor Cyan