---
title: N0N Ransomware - VPN/Firewall Exploitation Indicators
id: n0n-001-vpn-exploit
status: experimental
description: Detects authentication anomalies and process execution consistent with N0N VPN initial access
author: Security Arsenal Threat Intelligence
date: 2026/11/08
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: windows
detection:
  selection_vpn_fail:
    EventID:
      - 4625  # Failed logon
    LogonType: 3
    IpAddress|contains:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  selection_vpn_success:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'NTLM'
  timeframe: 5m
  condition: selection_vpn_fail | count() by SourceAddress > 10
falsepositives:
  - Legitimate VPN misconfiguration
  - Password spraying by red teams
level: high

---
title: N0N Ransomware - PsExec and WMI Lateral Movement
id: n0n-002-lateral-movement
status: experimental
description: Detects PsExec service creation and WMI process execution associated with N0N lateral movement
author: Security Arsenal Threat Intelligence
date: 2026/11/08
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PsExec.exe'
      - '\psexesvc.exe'
      - '\PSEXESVC.exe'
    CommandLine|contains:
      - '-accepteula'
      - '-s'
      - '-d'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative activity
  - SCCM or similar management tools
level: high

---
title: N0N Ransomware - Data Staging and Shadow Copy Deletion
id: n0n-003-staging-exfil
status: experimental
description: Detects data staging compression and Volume Shadow Copy deletion preceding N0N encryption
author: Security Arsenal Threat Intelligence
date: 2026/11/08
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_7zip:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\7zr.exe'
    CommandLine|contains:
      - 'a '
      - '-p'
      - 'vss'
  selection_rar:
    Image|endswith:
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - 'a '
      - '-hp'
      - '-m5'
  selection_vss_delete:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
  condition: selection_7zip or selection_rar or selection_vss_delete
falsepositives:
  - Legitimate backup operations
  - System administrator maintenance
level: critical

// N0N Ransomware Pre-Encryption Detection: Lateral Movement + Data Staging
// Hunt for PsExec, WMI, and data staging in 24-hour window
// Author: Security Arsenal Threat Intelligence
// Date: 2026-11-08

let TimeWindow = 24h;
let SuspiciousProcesses = dynamic(["psexec.exe", "psexesvc.exe", "7z.exe", "rar.exe", "winrar.exe", "vssadmin.exe", "wmic.exe"]);

// Stage 1: Identify potential initial access via VPN/RDP anomalies
let InitialAccess = SecurityEvent
    | where TimeGenerated > ago(TimeWindow)
    | where EventID in (4624, 4625)
    | where LogonType in (3, 10)  // Network and RemoteInteractive
    | where IpAddress !startswith "10." and IpAddress !startswith "192.168." and IpAddress !startswith "172."
    | summarize FailedAttempts = countif(EventID == 4625), SuccessAfterFail = countif(EventID == 4624) by Account, IpAddress, Computer
    | where FailedAttempts > 5 and SuccessAfterFail > 0;

// Stage 2: Detect lateral movement via PsExec/WMI
let LateralMovement = SecurityEvent
    | where TimeGenerated > ago(TimeWindow)
    | where EventID == 4688
    | where Process has_any (SuspiciousProcesses) or ParentProcessName has "WmiPrvSE"
    | extend CommandLine = tostring(parse_json(EventData).CommandLine)
    | where CommandLine has_any ("-accepteula", "delete shadows", "shadowcopy", "a ", "-hp")
    | project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName;

// Stage 3: Correlate with data staging on file servers
let DataStaging = DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where FileName in~ ("7z.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any ("a ", "-p", "-hp", "vss")
    | extend TargetFolder = extract(@"a\s+(?:-[^\s]+\s+)*\"?([^\"]+)\"?", 1, ProcessCommandLine)
    | where TargetFolder has_any ("\\\