Kettering Health Ransomware Attack: 1.7M Records Exposed — Detection and Hardening Guide

---
title: Potential Ransomware Shadow Copy Deletion
id: 9a4a7d1b-2b5c-4d8e-8f1a-3b6c5d7e9f0a
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin or wmic, a common precursor to ransomware execution to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2025/05/20
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: 1 of selection*
falsepositives:
  - Administrators managing disk space (rare in production)
level: high
---
title: Ransomware Backup Service Sabotage
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects commands used to stop or disable backup services (e.g., SQL Agent, VSS Writer) or delete backups using wbadmin.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2025/05/20
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete'
  selection_net_stop:
    Image|endswith: '\net.exe'
    CommandLine|contains:
      - 'stop "SQL ServerAGENT"'
      - 'stop VSS'
  condition: 1 of selection*
falsepositives:
  - Legitimate backup maintenance windows
level: high
---
title: Suspicious Mass File Encryption via PowerShell
id: c3d4e5f6-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects PowerShell scripts attempting to encrypt files or recurse through directories rapidly, indicative of ransomware behavior.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2025/05/20
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '.Encrypt('
      - 'Encrypt-File'
      - 'System.IO.Cryptography'
  condition: selection
falsepositives:
  - Legitimate encryption scripts by IT staff
level: medium

// Hunt for Ransomware Precursors: Shadow Copy Deletion and Service Stops
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ ("vssadmin.exe", "wbadmin.exe", "wmic.exe")
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "delete backup", "catalog")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(TimeFrame)
    | where FileName in~ ("net.exe", "sc.exe")
    | where ProcessCommandLine has_any ("stop", "disable")
    | where ProcessCommandLine has_any ("SQL", "VSS", "Backup", "MSSQLSERVER")
) on HostName
| project Timestamp, HostName, AccountName_Sabotage = AccountName1, CommandLine_Sabotage = ProcessCommandLine1, AccountName_Service = AccountName, CommandLine_Service = ProcessCommandLine

-- Hunt for Ransomware Precursors on Endpoint
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'vssadmin.exe'
   AND CommandLine =~ 'delete.*shadows'

UNION ALL

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'wbadmin.exe'
   AND CommandLine =~ 'delete'

# Kettering Health Incident Response: VSS and Backup Triage
Write-Host "[+] Checking VSS Service Status..."
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue

if ($vssService) {
    if ($vssService.Status -ne 'Running') {
        Write-Host "[!] CRITICAL: VSS Service is not running. Current State: $($vssService.Status)" -ForegroundColor Red
        Write-Host "[*] Attempting to start VSS Service..."
        Start-Service -Name VSS -ErrorAction Stop
    } else {
        Write-Host "[+] VSS Service is Running." -ForegroundColor Green
    }
} else {
    Write-Host "[!] ERROR: VSS Service not found on this system." -ForegroundColor Red
}

# Check for recent Shadow Copy Deletion events in System Log (Event ID 7036 or VSS specific errors)
Write-Host "[+] Checking System Event Logs for VSS stop events (Last 24 Hours)..."
$recentStops = Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036; Level=4; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
               Where-Object { $_.Message -like '*VSS*stopped*' }

if ($recentStops) {
    Write-Host "[!] WARNING: Detected recent stops of the VSS service." -ForegroundColor Red
    $recentStops | Select-Object TimeCreated, Message | Format-Table
} else {
    Write-Host "[+] No suspicious VSS stops detected in the last 24 hours." -ForegroundColor Green
}

# Ensure Shadow Copy Storage is accessible
Write-Host "[+] Checking for existing Shadow Copies..."
try {
    $shadowCopies = vssadmin list shadows
    if ($shadowCopies -match "No shadow copies found") {
        Write-Host "[!] WARNING: No Shadow Copies exist. System is vulnerable to data loss." -ForegroundColor Yellow
    } else {
        Write-Host "[+] Shadow Copies exist." -ForegroundColor Green
        # Output count (simple parsing)
        ($shadowCopies | Select-String "Shadow Copy Volume").Count
    }
} catch {
    Write-Host "[!] Error querying vssadmin. Verify execution permissions." -ForegroundColor Red
}