---
title: N0N Ransomware - VPN Anomaly Detection
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious VPN authentication patterns consistent with N0N initial access techniques, including impossible travel, brute force patterns, and access from known malicious infrastructure.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/11/07
modified: 2026/11/07
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
logsource:
  category: vpn
  product: cisco
  service: anyconnect
detection:
  selection_auth:
    - event.outcome: 'failure'
    - user.name|contains:
        - 'admin'
        - 'administrator'
        - 'svc'
        - 'service'
  selection_geo:
    source.ip|cidr:
      - '185.220.0.0/16'
      - '45.133.0.0/16'
      - '194.26.0.0/16'
  selection_impossible_travel:
    event.type: 'authentication'
    event.outcome: 'success'
    source.geo.country_iso_code|not_in:
      - 'US'
      - 'CA'
      - 'DE'
      - 'IT'
      - 'GB'
  condition: selection_auth or selection_geo or selection_impossible_travel
falsepositives:
  - Legitimate admin access from unusual locations
  - Service accounts with geographic distribution
level: high
---
title: N0N Ransomware - Macro Execution & Staging
id: 8b7c6d5e-4f3a-2b1c-0d9e-8f7a6b5c4d3e
status: experimental
description: Detects Office macro execution spawning suspicious processes, consistent with N0N phishing and initial access vectors.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1204/002/
date: 2026/11/07
modified: 2026/11/07
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_suspicious_cmd:
    CommandLine|contains:
      - '-enc'
      - '-e '
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'WebClient'
      - 'hidden'
      - 'bypass'
      - '-w hidden'
  condition: selection_parent and selection_child and selection_suspicious_cmd
falsepositives:
  - Legitimate administrative scripts
  - Software deployment tools
level: high
---
title: N0N Ransomware - Pre-Encryption Staging
id: 7c6d5e4f-3a2b-1c0d-9e8f-7a6b5c4d3e2f
status: experimental
description: Detects data staging and exfiltration preparation behaviors typical of N0N ransomware operations, including shadow copy deletion, backup enumeration, and mass file access.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1074/
date: 2026/11/07
modified: 2026/11/07
tags:
  - attack.impact
  - attack.t1490
  - attack.t1074.001
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'shadowcopy delete /all'
  selection_backup:
    Image|endswith:
      - '\wbadmin.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_mass_access:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'Get-ChildItem'
      - 'Compress-Archive'
      - 'tar.exe'
      - 'rar.exe'
      - '7z.exe'
  condition: 1 of selection_*
falsepositives:
  - System administrators performing maintenance
  - Backup software operations
level: critical

// N0N Ransomware - Lateral Movement & Staging Hunt
// Description: Identifies suspicious administrative tool usage, mass file access, 
// and pre-encryption behaviors across the network
// Author: Security Arsenal Threat Intelligence
// Date: 2026-11-07

let timeframe = 7d;
let suspiciousProcesses = dynamic(["psexec.exe", "wmic.exe", "powershell.exe", "cmd.exe", "vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "rclone.exe", "7z.exe", "rar.exe"]);
let stagingKeywords = dynamic(["shadowcopy", "delete shadows", "compress-archive", "tar.exe", "7z", "rar", "exfil", "stage", "backup", "vssadmin delete"]);

// Identify devices with suspicious process execution
DeviceProcessEvents
| where TimeGenerated > ago(timeframe)
| where FileName in~ (suspiciousProcesses)
| where ProcessCommandLine has_any (stagingKeywords) or 
        (FileName =~ "psexec.exe" and ProcessCommandLine contains "\\") or
        (FileName =~ "wmic.exe" and ProcessCommandLine contains "process call create")
| summarize 
    SuspiciousCommands = make_set(ProcessCommandLine),
    CommandCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by DeviceName, AccountName, FileName
| where CommandCount > 3
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeframe)
    | where RemotePort in (445, 3389, 5985, 5986)  // SMB, RDP, WinRM
    | where ActionType == "ConnectionSuccess"
    | summarize NetworkConnections = make_set(RemoteIP), ConnectionCount = count() by DeviceName
) on DeviceName
| extend RiskScore = case(
    CommandCount > 10 and ConnectionCount > 5, "Critical",
    CommandCount > 5 or ConnectionCount > 3, "High",
    "Medium"
)
| project 
    DeviceName, 
    AccountName, 
    FileName, 
    CommandCount, 
    SuspiciousCommands, 
    NetworkConnections, 
    ConnectionCount,
    RiskScore,
    FirstSeen, 
    LastSeen
| order by RiskScore desc, CommandCount desc

# N0N Ransomware - Pre-Encryption Detection Script
# Run as Administrator on critical servers and workstations
# Checks: Exposed RDP, Scheduled Tasks (7 days), VSS Status, Suspicious Admin Tools

$ReportPath = "C:\N0N_Check_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$CriticalFindings = @()

function Write-Log {
    param($Message, $Level="INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "[$timestamp] [$Level] $Message"
    Add-Content -Path $ReportPath -Value $logEntry
    Write-Host $logEntry
}

Write-Log "Starting N0N Pre-Ransomware Detection Check" "INFO"

# Check 1: RDP Exposure and Configuration
Write-Log "Checking RDP Configuration..." "INFO"
$RDPStatus = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
$NLAStatus = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -ErrorAction SilentlyContinue

if ($RDPStatus.fDenyTSConnections -eq 0) {
    Write-Log "RDP is ENABLED" "WARNING"
    if ($NLAStatus.UserAuthentication -eq 0) {
        $msg = "CRITICAL: RDP enabled WITHOUT Network Level Authentication (NLA) - High risk of brute force"
        Write-Log $msg "CRITICAL"
        $CriticalFindings += $msg
    } else {
        Write-Log "RDP enabled with NLA - verify strong passwords and MFA" "WARNING"
    }
} else {
    Write-Log "RDP is disabled - Good" "INFO"
}

# Check 2: Recently Created Scheduled Tasks (Last 7 Days)
Write-Log "Checking for suspicious scheduled tasks (last 7 days)..." "INFO"
$StartDate = (Get-Date).AddDays(-7)
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt $StartDate -and 
    ($_.TaskName -match "(Update|Maintenance|Adobe|Google|Microsoft|Java)" -or 
     $_.Actions.Execute -match "(powershell|cmd|wscript|cscript|rundll32|regsvr32|certutil|bitsadmin)")
} | Select-Object TaskName, TaskPath, Date, Actions

if ($SuspiciousTasks) {
    Write-Log "Found $($SuspiciousTasks.Count) recently created tasks with suspicious characteristics" "WARNING"
    $SuspiciousTasks | ForEach-Object {
        Write-Log "  Task: $($_.TaskName) | Path: $($_.TaskPath) | Date: $($_.Date)" "WARNING"
        $CriticalFindings += "Suspicious task: $($_.TaskName)"
    }
} else {
    Write-Log "No suspicious scheduled tasks found" "INFO"
}

# Check 3: Volume Shadow Copy Status
Write-Log "Checking Volume Shadow Copy status..." "INFO"
$VSSStatus = vssadmin list shadows 2>&1
if ($LASTEXITCODE -ne 0 -or $VSSStatus -match "No items found") {
    $msg = "CRITICAL: No Volume Shadow Copies found - Potential anti-forensic/anti-recovery activity"
    Write-Log $msg "CRITICAL"
    $CriticalFindings += $msg
} else {
    $ShadowCount = ($VSSStatus | Select-String "Shadow Copy ID").Count
    Write-Log "Found $ShadowCount shadow copies - verify integrity" "INFO"
}

# Check 4: Suspicious Processes (PsExec, WMI persistence)
Write-Log "Checking for suspicious administrative tools..." "INFO"
$SuspiciousProcs = Get-Process | Where-Object {
    $_.ProcessName -match "(psexec|wmic|powershell_ise|rclone|7z|rar|tar|nc|ncat|netcat)"
}

if ($SuspiciousProcs) {
    Write-Log "Suspicious processes detected:" "WARNING"
    $SuspiciousProcs | ForEach-Object {
        Write-Log "  $($_.ProcessName) (PID: $($_.Id)) - Path: $($_.Path)" "WARNING"
        $CriticalFindings += "Suspicious process: $($_.ProcessName)"
    }
}

# Check 5: Network Connections (SMB/RDP brute force indicators)
Write-Log "Checking for suspicious network connections..." "INFO"
$SMBConnections = Get-NetTCPConnection -LocalPort 445 -State Established -ErrorAction SilentlyContinue | 
    Where-Object { $_.RemoteAddress -notmatch "^(10\.|172\.|192\.168\.|127\.)" }
$RDPConnections = Get-NetTCPConnection -LocalPort 3389 -State Established -ErrorAction SilentlyContinue | 
    Where-Object { $_.RemoteAddress -notmatch "^(10\.|172\.|192\.168\.|127\.)" }

if ($SMBConnections) {
    Write-Log "External SMB connections detected (lateral movement risk):" "WARNING"
    $SMBConnections | ForEach-Object {
        Write-Log "  Remote: $($_.RemoteAddress):$($_.RemotePort)" "WARNING"
    }
}

if ($RDPConnections) {
    Write-Log "External RDP connections detected:" "WARNING"
    $RDPConnections | ForEach-Object {
        Write-Log "  Remote: $($_.RemoteAddress):$($_.RemotePort)" "WARNING"
        $CriticalFindings += "External RDP from $($_.RemoteAddress)"
    }
}

# Check 6: Recent File Modifications in System Directories
Write-Log "Checking for recently modified critical system files..." "INFO"
$RecentFiles = Get-ChildItem -Path "C:\Windows\System32", "C:\Windows\SysWOW64" -Include "*.exe", "*.dll" -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt $StartDate } | 
    Select-Object Name, FullName, LastWriteTime

if ($RecentFiles) {
    Write-Log "Recently modified system files (potential malware):" "WARNING"
    $RecentFiles | ForEach-Object {
        Write-Log "  $($_.Name) - Modified: $($_.LastWriteTime)" "WARNING"
    }
}

# Summary
Write-Log "===== SCAN COMPLETE =====" "INFO"
Write-Log "Report saved to: $ReportPath" "INFO"

if ($CriticalFindings.Count -gt 0) {
    Write-Log "CRITICAL FINDINGS DETECTED: $($CriticalFindings.Count)" "CRITICAL"
    $CriticalFindings | ForEach-Object { Write-Log "  - $_" "CRITICAL" }
    exit 1
} else {
    Write-Log "No critical indicators found" "INFO"
    exit 0
}