---
title: N0N Ransomware - Phishing Macro Execution Followed by LOLBin Abuse
id: 9a3f2c1e-7d4b-4e8f-a1c2-3b5d6e7f8a9b
status: experimental
description: Detects Office macro execution spawning suspicious child processes consistent with ransomware initial access via phishing attachments, as observed in N0N affiliate campaigns.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1566/001/
  - https://attack.mitre.org/techniques/T1059/005/
date: 2026/11/08
modified: 2026/11/08
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Office add-ins spawning shell processes
  - IT automation scripts triggered from documents
level: high
---
title: N0N Ransomware - RDP Brute Force Followed by Successful Authentication
id: 2b4d6f8a-1c3e-5a7b-9d0f-2e4c6a8b0d1f
status: experimental
description: Detects patterns of repeated failed RDP logons followed by a successful logon from the same source, consistent with RDP brute-force initial access used by ransomware affiliates.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1110/
  - https://attack.mitre.org/techniques/T1021/001/
date: 2026/11/08
modified: 2026/11/08
tags:
  - attack.credential_access
  - attack.t1110
  - attack.lateral_movement
  - attack.t1021.001
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
  timeframe: 10m
  condition: selection_failed | count() by SourceIp > 20
  # Correlate: failed count >20 from SourceIp within 10m, followed by success from same SourceIp
falsepositives:
  - Misconfigured service accounts with cached bad credentials
  - Vulnerability scanners performing authentication tests
level: high
---
title: N0N Ransomware - Pre-Encryption Staging and Shadow Copy Deletion
id: 7c5e9a1b-3d6f-4a8c-b2e4-6d8f0a2c4e6g
status: experimental
description: Detects volume shadow copy deletion and suspicious data archiving activity indicative of pre-encryption staging, a hallmark of N0N and comparable ransomware operations.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1560/001/
date: 2026/11/08
modified: 2026/11/08
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\diskshadow.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete catalog'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -hp'
  condition: selection_vss or selection_archive
falsepositives:
  - Legitimate backup operations
  - IT administrator shadow copy management
  - Software packaging using 7-Zip or WinRAR
level: critical

// N0N Ransomware - Lateral Movement & Pre-Encryption Staging Hunt
// Microsoft Sentinel / Defender XDR Advanced Hunting
// Looks for: PsExec-style service creation, WMI remote execution,
// suspicious archive creation, and shadow copy tampering within a 7-day window.

let Lookback = 7d;

// 1. PsExec-style remote service creation
let PsExecActivity =
    DeviceEvents
    | where Timestamp >= ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any ("PSEXESVC", "PAExec", "csexec", "remcom")
       or (ServiceName matches regex "^[A-Za-z0-9]{8}$" and ServiceName !in~ ("trustedinstaller"))
    | project Timestamp, DeviceName, ServiceName, InitiatingProcessAccountName, InitiatingProcessFileName;

// 2. WMI remote process execution
let WmiActivity =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where FileName =~ "wmiprvse.exe"
    | where InitiatingProcessFileName !in~ ("svchost.exe", "wmiprvse.exe", "")
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;

// 3. Suspicious archive creation (data staging)
let ArchiveActivity =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" a ", " -p", " -hp")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, FolderPath;

// 4. Shadow copy deletion / backup tampering
let ShadowTampering =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where (FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe", "diskshadow.exe")
        and ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "recoveryenabled no", "delete catalog"))
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName;

// Union and correlate by device
PsExecActivity
| union WmiActivity, ArchiveActivity, ShadowTampering
| summarize ActivityCount = count(), ActivityTypes = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName
| where ActivityCount >= 2
| order by ActivityCount desc

# N0N Ransomware Rapid Response Script
# Checks for: exposed RDP, recent scheduled tasks, shadow copy status, suspicious services
# Run as Administrator. Outputs to console and optional log file.

param(
    [string]$LogPath = "$env:TEMP\N0N_RapidResponse_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
)

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $entry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Level] $Message"
    Write-Host $entry
    Add-Content -Path $LogPath -Value $entry
}

Write-Log "=== N0N Ransomware Rapid Response Check ===" "HEADER"
Write-Log "Log file: $LogPath"

# --- 1. Check RDP exposure ---
Write-Log "`n--- [1] RDP Exposure Check ---"
$rdpEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
if ($rdpEnabled -eq 0) {
    Write-Log "RDP is ENABLED on this host." "WARN"
    $rdpPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
    Write-Log "RDP Port: $rdpPort"
    $rdpListeners = Get-NetTCPConnection -LocalPort $rdpPort -State Listen -ErrorAction SilentlyContinue
    if ($rdpListeners) {
        Write-Log "RDP is actively LISTENING. Verify network-level restrictions (VPN-only, IP allowlist)." "CRITICAL"
    }
    # Check NLA
    $nla = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
    if ($nla -ne 1) {
        Write-Log "Network Level Authentication (NLA) is DISABLED. Enable immediately." "CRITICAL"
    } else {
        Write-Log "NLA is enabled." "OK"
    }
} else {
    Write-Log "RDP is disabled." "OK"
}

# --- 2. Scheduled tasks created in last 7 days ---
Write-Log "`n--- [2] Recent Scheduled Tasks (Last 7 Days) ---"
$cutoff = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date -gt $cutoff) } | Select-Object TaskName, TaskPath, Date, Author, State
if ($recentTasks) {
    Write-Log "Found $($recentTasks.Count) scheduled task(s) created in the last 7 days:" "WARN"
    foreach ($task in $recentTasks) {
        Write-Log "  - $($task.TaskPath)$($task.TaskName) | Created: $($task.Date) | Author: $($task.Author) | State: $($task.State)" "WARN"
    }
} else {
    Write-Log "No scheduled tasks created in the last 7 days." "OK"
}

# --- 3. Volume Shadow Copy status ---
Write-Log "`n--- [3] Volume Shadow Copy Status ---"
$shadows = Get-CimInstance -ClassName Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Log "Shadow copies present: $($shadows.Count)" "OK"
    foreach ($s in $shadows) {
        Write-Log "  - ID: $($s.ID) | Created: $($s.InstallDate) | Volume: $($s.VolumeName)"
    }
} else {
    Write-Log "NO shadow copies found. This may indicate pre-encryption tampering (T1490)." "CRITICAL"
}

# Check VSS service status
$vss = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vss.Status -ne 'Running') {
    Write-Log "VSS service is $($vss.Status). Expected: Running." "WARN"
}

# --- 4. Suspicious services (recently created, non-standard paths) ---
Write-Log "`n--- [4] Suspicious Services (Last 7 Days) ---"
$recentServices = Get-CimInstance -ClassName Win32_Service | Where-Object {
    $_.PathName -and
    ($_.PathName -notmatch 'system32|SysWOW64|Program Files|Windows Defender') -and
    ($_.State -eq 'Running')
} | Select-Object Name, DisplayName, PathName, StartName, State
if ($recentServices) {
    Write-Log "Found $($recentServices.Count) running service(s) with non-standard binary paths:" "WARN"
    foreach ($svc in $recentServices) {
        Write-Log "  - $($svc.Name) | $($svc.PathName) | RunAs: $($svc.StartName)" "WARN"
    }
} else {
    Write-Log "No suspicious running services with non-standard paths detected." "OK"
}

# --- 5. Recent failed logon summary (RDP brute-force indicator) ---
Write-Log "`n--- [5] Failed Logon Summary (Last 24h) ---"
$failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 500 -ErrorAction SilentlyContinue
if ($failedLogons) {
    $grouped = $failedLogons | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10
    Write-Log "Top source IPs for failed logons (last 24h):" "WARN"
    foreach ($g in $grouped) {
        Write-Log "  - $($g.Name): $($g.Count) failures" "WARN"
    }
} else {
    Write-Log "No failed logon events in the last 24 hours." "OK"
}

Write-Log "`n=== Check Complete. Review any CRITICAL or WARN items immediately. ===" "HEADER"
Write-Log "Full log saved to: $LogPath"