Ransomware Attacks Hit Record High in 2026: 1,073 Organizations Hit in August — Detection and Hardening Guide for Industrial Defenders

---
title: Ransomware Shadow Copy Deletion via Vssadmin WMIC or Diskshadow
id: 3f8a1c44-2b7e-4d91-a6c3-9e5f2d8b1a07
status: experimental
description: Detects deletion of volume shadow copies, a hallmark ransomware behavior performed immediately before mass encryption to inhibit recovery (MITRE T1490).
references:
  - https://www.infosecurity-magazine.com/news/ransomware-attacks-reach-record/
  - https://attack.mitre.org/techniques/T1490/
  - https://www.cisa.gov/stopransomware
author: Security Arsenal
date: 2026/09/08
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_diskshadow:
    Image|endswith: '\\diskshadow.exe'
    CommandLine|contains: 'delete shadows'
  condition: 1 of selection_*
falsepositives:
  - Rare legitimate storage reconfiguration by backup administrators; whitelist approved admin accounts and change windows
level: critical
---
title: Boot Recovery Options Disabled via Bcdedit
id: 8c2e5a19-6f4b-4a37-b9d2-1c7e3f5a9d42
status: experimental
description: Detects bcdedit being used to disable Windows recovery mode or ignore boot failures, a standard pre-encryption ransomware step to prevent victim self-recovery (MITRE T1490).
references:
  - https://www.infosecurity-magazine.com/news/ransomware-attacks-reach-record/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/09/08
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\\bcdedit.exe'
  selection_cli:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'recoveryenabled  no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: all of selection_*
falsepositives:
  - Uncommon; some system imaging or kiosk hardening scripts modify boot configuration
level: high
---
title: Ransom Note Artifact Creation in User Directories
id: 5d1b7e83-3c9a-4e62-b8f4-2a6d9c1e7b53
status: experimental
description: Detects creation of common ransom note filenames across user-writable directories. Tune the filename list against leak-site intelligence for families active in your sector.
references:
  - https://www.infosecurity-magazine.com/news/ransomware-attacks-reach-record/
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/09/08
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\HOW_TO_DECRYPT'
      - '\\RECOVER-FILES'
      - '\\READ_ME_FOR_DECRYPT'
      - '\\DECRYPT_INSTRUCTION'
      - '\\RESTORE_FILES_INFO'
      - '\\HOW_TO_RESTORE'
falsepositives:
  - Security team tabletop exercises or ransomware simulators; maintain an approved-testing exclusion list
level: critical

// Hunt: Ransomware pre-encryption defense evasion (T1490)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
    or (FileName =~ "diskshadow.exe" and ProcessCommandLine has "delete shadows")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Hunt: Mass file rename/modification velocity — active encryption indicator (T1486)
let Threshold = 100;
DeviceFileEvents
| where TimeGenerated > ago(15m)
| where ActionType in ("FileRenamed", "FileModified")
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "explorer.exe", "SearchIndexer.exe", "OneDrive.exe")
| summarize FileOps = count(), DistinctExtensions = dcount_if(FileExtension, isnotempty(FileExtension)), DistinctPaths = dcount(FolderPath)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 5m)
| where FileOps > Threshold and DistinctPaths > 10
| order by FileOps desc;

// Hunt: New process launches from user-writable paths by non-admin context (common encryptor staging)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FolderPath has_any (@"C:\Users\Public\", @"\AppData\Local\Temp\", @"\AppData\Roaming\", @"C:\ProgramData\")
| where FileName !in~ ("chrome.exe", "msedge.exe", "Teams.exe", "OneDriveSetup.exe", "slack.exe", "zoom.exe")
| where ProcessCommandLine has_any ("encrypt", "--path", "-nomutex") or FileName endswith ".tmp.exe"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

-- Hunt: Ransomware pre-encryption behavior and encryptor staging artifacts
-- Covers T1490 (recovery inhibition) process lineage + suspicious binaries in user-writable paths

LET proc_hits = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(vssadmin.*delete shadows|wmic.*shadowcopy|bcdedit.*recoveryenabled no|bcdedit.*ignoreallfailures|diskshadow.*delete shadows)'
   OR Exe =~ '(?i)(\\\\Users\\\\Public\\\\|AppData\\\\Local\\\\Temp\\\\|AppData\\\\Roaming\\\\)'

LET staging_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/Public/**/*.exe', 'C:/ProgramData/**/*.exe', 'C:/Users/*/AppData/Local/Temp/*.exe'])
WHERE Mtime > now() - 86400
  AND NOT FullPath =~ '(?i)(teams|onedrive|chrome|edge|slack|zoom)update'

SELECT * FROM proc_hits
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'STAGED_BINARY' AS Name, FullPath AS Exe,
       format(format='size=%d mtime=%v', args=[Size, Mtime]) AS CommandLine,
       NULL AS Username, Btime AS CreateTime
FROM staging_files

# Security Arsenal — Ransomware Resilience Audit (read-only verification)
# Run elevated. Review output for FAIL lines before treating a host as clean/hardened.

Write-Host "`n=== Volume Shadow Copy Status (T1490 target) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Host "PASS: $($shadows.Count) shadow copies present." -ForegroundColor Green
    $shadows | Select-Object VolumeName, InstallDate | Format-Table
} else {
    Write-Host "FAIL: No shadow copies found. Verify VSS is enabled and check for recent deletion (wepsvc/vssadmin event logs)." -ForegroundColor Red
}
$vss = Get-Service VSS, swprv -ErrorAction SilentlyContinue
$vss | Select-Object Name, Status, StartType | Format-Table

Write-Host "`n=== Boot Recovery Configuration (bcdedit) ===" -ForegroundColor Cyan
$bcd = bcdedit /enum {current} 2>$null | Out-String
if ($bcd -match "recoveryenabled\s+No") {
    Write-Host "FAIL: Windows recovery is DISABLED — consistent with ransomware tampering. Re-enable: bcdedit /set {current} recoveryenabled yes" -ForegroundColor Red
} else {
    Write-Host "PASS: Recovery enabled." -ForegroundColor Green
}

Write-Host "`n=== Controlled Folder Access (ransomware file-protection) ===" -ForegroundColor Cyan
$cfa = Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess -ErrorAction SilentlyContinue
switch ($cfa) {
    1 { Write-Host "PASS: Controlled Folder Access enabled." -ForegroundColor Green }
    2 { Write-Host "WARN: CFA in audit mode only — consider enforcing." -ForegroundColor Yellow }
    default { Write-Host "FAIL: Controlled Folder Access disabled. Enable: Set-MpPreference -EnableControlledFolderAccess Enabled" -ForegroundColor Red }
}

Write-Host "`n=== Tamper Protection & Real-Time AV ===" -ForegroundColor Cyan
$mp = Get-MpComputerStatus
[PSCustomObject]@{
    TamperProtected      = $mp.IsTamperProtected
    RealTimeProtection   = $mp.RealTimeProtectionEnabled
    AntivirusSignatureAge = $mp.AntivirusSignatureAge
} | Format-List
if (-not $mp.IsTamperProtected) { Write-Host "FAIL: Tamper Protection off — enable via Intune/Defender portal." -ForegroundColor Red }
if ($mp.AntivirusSignatureAge -gt 1) { Write-Host "WARN: Signatures $($mp.AntivirusSignatureAge) days old." -ForegroundColor Yellow }

Write-Host "`n=== SMBv1 (legacy lateral-movement surface) ===" -ForegroundColor Cyan
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smb1.State -eq 'Enabled') { Write-Host "FAIL: SMBv1 enabled. Disable: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart" -ForegroundColor Red }
else { Write-Host "PASS: SMBv1 disabled/not present." -ForegroundColor Green }

Write-Host "`n=== Exposed RDP & Backup Service Health ===" -ForegroundColor Cyan
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) { Write-Host "WARN: RDP listening. Confirm it is NOT internet-exposed and is behind VPN + MFA + NLA." -ForegroundColor Yellow }
Get-Service -Name "Veeam*","*backup*" -ErrorAction SilentlyContinue | Select-Object Name, Status | Format-Table

Write-Host "`n=== Recent Suspicious Process Evidence (last 72h) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-72)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'vssadmin.*delete shadows|wmic.*shadowcopy|bcdedit.*recoveryenabled no|diskshadow.*delete shadows' } |
  Select-Object -First 10 TimeCreated, @{n='Detail';e={($_.Message -split "`n")[0..8] -join ' '}} | Format-List