Pure Extortion Tactics 2026: Detection and Defense Against Non-Encryption Ransomware

---
title: Potential Data Staging via High-Volume Archiving
id: 9c8f7a1e-2b4d-4c5e-9f1a-8b7d6c5e4f3a
status: experimental
description: Detects suspicious archiving of large data volumes indicative of data staging for extortion. Focuses on 7-Zip and WinRAR usage with password protection flags.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_archivers:
    Image|endswith:
      - '\7z.exe'
      - '\winrar.exe'
      - '\rar.exe'
  selection_flags:
    CommandLine|contains:
      - '-p'  # Password protection
      - '-m0' # Compression method/store
      - '-hp' # Hide passwords
  selection_volume:
    # Contextual check: Archiving common user document roots or large directories
    CommandLine|contains:
      - 'C:\Users\'
      - 'C:\Documents'
      - 'D:\'
  condition: all of selection_*
falsepositives:
  - Legitimate system backups by administrators
  - User zipping personal files
level: high
---
title: Suspicious Rclone Cloud Exfiltration Activity
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the use of rclone, a tool frequently abused by threat actors for exfiltration to cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'sync'
      - 'copy'
      - 'lsf'  # List files, often used for recon
      - 'mega:'
      - 'pcloud:'
  condition: selection
falsepositives:
  - Authorized use of rclone by DevOps engineers
level: critical


**KQL (Microsoft Sentinel / Defender)**

// Hunt for large egress traffic potentially indicating data exfiltration
let TimeThreshold = 1h;
let DataThreshold = 500000000; // 500MB
DeviceNetworkEvents
| where Timestamp > ago(TimeThreshold)
| where ActionType == "ConnectionSuccess" 
| where RemotePort in (443, 21, 22, 8443)
| summarize TotalBytesSent = sum(SentBytes) by DeviceName, InitiatingProcessAccountName, RemoteUrl
| where TotalBytesSent > DataThreshold
| join kind=inner ( 
    DeviceProcessEvents 
    | where Timestamp > ago(TimeThreshold)
    | where ProcessVersionInfoOriginalFileName in ("7z.exe", "winrar.exe", "rar.exe", "rclone.exe")
    | project DeviceName, ArchivingProcess = FileName, ArchivingCommandLine = CommandLine
) on DeviceName
| project DeviceName, Account = InitiatingProcessAccountName, TotalBytesSent, RemoteUrl, ArchivingProcess, ArchivingCommandLine


**Velociraptor VQL**

-- Hunt for recently created archive files potentially used for staging
SELECT FullPath, Size, Mtime, Mode, SID
FROM glob(globs="/*" + string(split(array=extensions, sep=",")), root="/")
WHERE Mode.Type = "reg" 
  AND ( Name =~ '\.zip$' OR Name =~ '\.rar$' OR Name =~ '\.7z$' )
  AND Mtime > now() - 24h
  AND Size > 10000000  -- Greater than 10MB
ORDER BY Mtime DESC
LIMIT 100


**Remediation Script (PowerShell)**

# Audit for potential data staging: Large Archives on user drives
# Run as Administrator to scan C:

$Drives = @("C:", "D:")
$MinSizeMB = 50
$Extensions = @("*.zip", "*.rar", "*.7z")
$DaysBack = 7

Write-Host "[+] Scanning for large archive files created in the last $DaysBack days..."

foreach ($Drive in $Drives) {
    if (Test-Path $Drive) {
        Get-ChildItem -Path $Drive -Recurse -Include $Extensions -ErrorAction SilentlyContinue | 
        Where-Object { $_.Length -gt ($MinSizeMB * 1MB) -and $_.LastWriteTime -gt (Get-Date).AddDays(-$DaysBack) } | 
        Select-Object FullName, @{Name='SizeMB';Expression={[math]::Round($_.Length / 1MB, 2)}}, LastWriteTime, @{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}} | 
        Format-Table -AutoSize
    }
}

# Audit Network Shares for Everyone/Anonymous access
Write-Host "[+] Checking for insecure SMB Shares..."
Get-SmbShare | Where-Object { $_.Special -eq $false } | ForEach-Object {
    $SharePath = $_.Path
    $Acl = Get-Acl -Path $SharePath
    $Acl.Access | Where-Object { $_.IdentityReference -like "*Everyone*" -or $_.IdentityReference -like "*Anonymous*" -and $_.FileSystemRights -match "Read|Write" } | 
    Select-Object @{Name='ShareName';Expression={$_.Name}}, @{Name='Path';Expression={$SharePath}}, IdentityReference, FileSystemRights
}