METAENCRYPTOR Ransomware Gang: 2 East Asian Manufacturing Giants Posted in 24h — Sector Targeting Analysis & Detection Rules

---
title: METAENCRYPTOR - Shadow Copy Deletion Pre-Ransomware Staging
id: 8f3a1c2e-9b4d-4e7a-a1f6-2c5d8e9f0a11
status: production
description: Detects deletion of Volume Shadow Copies via vssadmin, wmic, bcdedit, or PowerShell — METAENCRYPTOR consistently removes recovery options 24-72h before detonation.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_img:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd:
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'resize shadowstorage'
            - 'recoveryenabled no'
            - 'Get-WmiObject Win32_Shadowcopy'
            - 'Win32_ShadowCopy | Remove-WmiObject'
    condition: selection_img and selection_cmd
falsepositives:
    - Legitimate backup maintenance scripts (rare on servers; alert anyway)
tags:
    - attack.impact
    - attack.t1490
date: 2026/09/15
---
title: METAENCRYPTOR - PsExec or WMI Lateral Movement to Multiple Hosts
id: 7a2b3c4d-5e6f-4a8b-9c0d-1e2f3a4b5c22
status: production
description: Detects rapid sequential PsExec service creation or WMI remote process execution consistent with METAENCRYPTOR affiliates pushing encryptors and staging tools across domain hosts.
author: Security Arsenal Threat Intel
logsource:
    product: windows
    service: system
level: high
detection:
    selection:
        EventID: 7045
        ServiceName|contains:
            - 'PSEXESVC'
            - 'PAExec'
            - 'csexec'
    filter_legit:
        ServiceFileName|contains:
            - '\admin$\'
            - 'SCCM'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate admin tooling (SCCM, PDQ Deploy) — baseline and exclude known service names
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1569.002
date: 2026/09/15
---
title: METAENCRYPTOR - Rclone or Cloud Sync Exfiltration Staging
id: 3d4e5f6a-7b8c-4d9e-0f1a-2b3c4d5e6f33
status: production
description: Detects execution of Rclone or renamed copies commonly used by METAENCRYPTOR for bulk exfiltration of CAD, ERP, and HR data to cloud storage before encryption.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_name:
        OriginalFileName: 'rclone.exe'
    selection_img:
        Image|endswith: '\rclone.exe'
    selection_cmd:
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'move'
            - '--transfers'
            - 'mega'
            - 's3'
            - 'b2'
    condition: (selection_name or selection_img) and selection_cmd
falsepositives:
    - Legitimate cloud backup workflows — allowlist by service account and path
tags:
    - attack.exfiltration
    - attack.t1567.002
date: 2026/09/15

// Security Arsenal — METAENCRYPTOR Pre-Detonation Hunt (Microsoft Sentinel)
// Hunts for the gang's lateral movement + staging pattern: edge device logon anomaly
// -> suspicious service installs -> shadow copy tampering -> bulk archive creation
let Lookback = 14d;
let SuspectHosts =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
    | summarize FirstShadowDel = min(Timestamp) by DeviceName;
let ServicePushes =
    Event
    | where TimeGenerated > ago(Lookback)
    | where EventLog == "System" and EventID == 7045
    | extend Rendered = tostring(EventData)
    | where Rendered has_any ("PSEXESVC", "PAExec", "rclone")
    | summarize ServiceInstalls = count(), Services = make_set(Rendered, 5)
        by Computer, bin(TimeGenerated, 1h)
    | where ServiceInstalls >= 3;
let ArchiveStaging =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FileName endswith_any (".zip", ".7z", ".rar")
    | where FolderPath has_any ("\\Cad", "\\Drawings", "\\PLM", "\\Finance", "\\HR", "\\Users\\")
    | summarize ArchiveFiles = count(), SamplePaths = make_set(FolderPath, 5)
        by DeviceName, bin(Timestamp, 6h)
    | where ArchiveFiles >= 20;
SuspectHosts
| join kind=inner (ServicePushes) on $left.DeviceName == $right.Computer
| join kind=inner (ArchiveStaging) on $left.DeviceName == $right.DeviceName
| project DeviceName, FirstShadowDel, ServiceInstalls, ArchiveFiles, SamplePaths
| sort by FirstShadowDel asc;

# Security Arsenal Rapid Response — METAENCRYPTOR Pre-Encryption Indicator Sweep
# Run on suspect servers/DCs. Checks: new scheduled tasks (7d), shadow copy state,
# suspicious service installs, exposed RDP, and recent Rclone/tool staging artifacts.
$Report = "C:\IR_Sweep_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).txt"
"=== METAENCRYPTOR RAPID RESPONSE SWEEP - $(Get-Date) ===" | Out-File $Report

"`n[1] Scheduled tasks created/modified in last 7 days (non-Microsoft):" | Out-File $Report -Append
Get-ScheduledTask | Where-Object {
    $_.Date -and (New-TimeSpan -Start $_.Date -End (Get-Date)).Days -le 7 -and
    $_.TaskPath -notlike "\Microsoft*"
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-Table -AutoSize | Out-File $Report -Append

"`n[2] Volume Shadow Copy status (should be non-zero; empty = T-1490 tampering):" | Out-File $Report -Append
$vss = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $vss) { "  !! NO SHADOW COPIES PRESENT — POSSIBLE PRE-ENCRYPTION STAGING !!" | Out-File $Report -Append }
else { $vss | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize | Out-File $Report -Append }

"`n[3] Services installed in last 7 days (PsExec/RMM abuse indicator):" | Out-File $Report -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List | Out-File $Report -Append

"`n[4] RDP exposure & NLA state:" | Out-File $Report -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"  RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES — VERIFY INTERNET EXPOSURE'}else{'No'})" | Out-File $Report -Append
"  NLA Enforced: $(if($nla.UserAuthentication -eq 1){'Yes'}else{'NO — HARDEN IMMEDIATELY'})" | Out-File $Report -Append

"`n[5] Recent suspicious binaries in staging locations (7d):" | Out-File $Report -Append
Get-ChildItem "C:\ProgramData","C:\Windows\Temp","C:\Users\Public" -Recurse -Depth 2 -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and
    $_.Name -match 'rclone|psexec|psexesvc|7z|mega|nc\.|plink|chisel|frp' } |
  Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize | Out-File $Report -Append

"`n[6] Recent failed logons (brute-force / credential-stuffing pattern):" | Out-File $Report -Append
(Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
  Group-Object -Property {$_.Properties[19].Value} | Sort-Object Count -Descending | Select-Object -First 10 Name, Count |
  Format-Table -AutoSize) | Out-File $Report -Append

Write-Host "Sweep complete: $Report" -ForegroundColor Cyan