Ransomware Surge in July: Detection and Hardening Guidance for Finance, Technology, and Healthcare Defenders

---
title: Shadow Copy Deletion via Command Line - Ransomware Impact Preparation
id: 8f2c4a11-7b3d-4e5f-9a01-2c6d8e4f5a7b
status: experimental
description: Detects deletion of volume shadow copies via vssadmin, wmic, or PowerShell, a hallmark pre-encryption behavior in ransomware intrusions targeting finance, technology, and healthcare organizations.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.infosecurity-magazine.com/news/ransomware-surges-july-q2-lull/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'DeleteShadows'
      - 'Win32_ShadowCopy'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup maintenance scripts (rare; validate against change windows)
  - System administrators performing storage reclamation
level: high
---
title: Boot Configuration and Recovery Options Tampering via bcdedit
id: 3d9e7b22-1c4f-4a6e-8b02-5d7c9f3a6b8c
status: experimental
description: Detects bcdedit modifications disabling recovery mode or ignoring boot failures, a technique used by ransomware operators to prevent system recovery during encryption events.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.infosecurity-magazine.com/news/ransomware-surges-july-q2-lull/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\bcdedit.exe'
  selection_cli:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cli
falsepositives:
  - Rare; some imaging or kiosk hardening scripts modify boot policy
level: high
---
title: Ransomware Note Artifact Creation in User Directories
id: 6b1a8d33-9e5c-4f7d-ac13-8e4d0a2b7c9d
status: experimental
description: Detects creation of files matching common ransomware note naming patterns across user and public directories, indicating an active or completed encryption event.
references:
  - https://attack.mitre.org/techniques/T1486/
  - https://www.infosecurity-magazine.com/news/ransomware-surges-july-q2-lull/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'DECRYPT'
      - 'HOW_TO_DECRYPT'
      - 'RECOVER_FILES'
      - 'RESTORE_FILES'
      - 'README_FOR_DECRYPT'
      - 'READ_ME_TO_RECOVER'
    TargetFilename|endswith:
      - '.txt'
      - '.hta'
      - '.html'
  condition: selection
falsepositives:
  - Security tooling or canary files intentionally named to lure ransomware
  - Rare legitimate documentation files (tune allowlist per environment)
level: critical

// Hunt: Pre-encryption ransomware preparation behaviors
// Targets shadow copy deletion, boot tampering, and backup service disruption
// across the estate over a 7-day window.
let lookback = 7d;
let suspiciousCmds = dynamic([
  "delete shadows", "shadowcopy delete", "DeleteShadows",
  "Win32_ShadowCopy", "recoveryenabled no",
  "bootstatuspolicy ignoreallfailures", "wbadmin delete catalog",
  "wbadmin delete systemstatebackup"
]);
union isfuzzy=true
  (DeviceProcessEvents
  | where Timestamp > ago(lookback)
  | where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe", "powershell.exe", "pwsh.exe")
  | where ProcessCommandLine has_any (suspiciousCmds)
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, ReportId),
  (SecurityEvent
  | where TimeGenerated > ago(lookback)
  | where EventID == 4688
  | where NewProcessName has_any ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe", "powershell.exe")
  | where CommandLine has_any (suspiciousCmds)
  | project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName)
| sort by Timestamp desc

// Hunt: Mass file rename/modification indicative of active encryption
// Flags single devices with abnormally high file operation volume in short windows.
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType in ("FileRenamed", "FileModified")
| where InitiatingProcessFileName !in~ ("explorer.exe", "onedrive.exe", "searchprotocolhost.exe", "searchindexer.exe", "svchost.exe")
| summarize FileOps = count(), DistinctExtensions = dcount(tostring(split(FileName, ".")[-1])), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 10m)
| where FileOps > 500 and DistinctExtensions > 10
| extend DurationSeconds = datetime_diff("second", LastSeen, FirstSeen)
| sort by FileOps desc

-- Hunt artifact: Ransomware preparation and impact indicators
-- Stage 1: Process execution matching pre-encryption behaviors
LET proc_hits = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|bootstatuspolicy ignoreallfailures|wbadmin delete|bcdedit)'

-- Stage 2: Ransom note artifacts across user profiles
LET note_hits = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/Desktop/*DECRYPT*',
  'C:/Users/*/Documents/*DECRYPT*',
  'C:/Users/*/Desktop/*RECOVER*',
  'C:/Users/*/Desktop/*README*',
  'C:/Users/Public/**/*DECRYPT*'
])
WHERE Size < 1048576

SELECT 'Process' AS IndicatorType, CommandLine AS Indicator, Username AS Context, CreateTime AS Timestamp FROM proc_hits
UNION ALL
SELECT 'RansomNote' AS IndicatorType, FullPath AS Indicator, format(format='%d bytes', args=Size) AS Context, Mtime AS Timestamp FROM note_hits
ORDER BY Timestamp DESC

# Ransomware resilience audit and hardening script
# Run elevated on Windows endpoints and servers. Read-only audit by default;
# pass -Remediate to apply hardening changes.

param([switch]$Remediate)

Write-Host "=== Ransomware Resilience Audit ===" -ForegroundColor Cyan

# 1. Verify VSS service is not disabled and shadow copies exist
$vss = Get-Service -Name VSS -ErrorAction SilentlyContinue
Write-Host "[1] VSS Service Status: $($vss.Status) / StartType: $($vss.StartType)"
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
Write-Host "    Shadow copies present: $($shadows.Count)"
if ($Remediate -and $vss.StartType -eq 'Disabled') {
    Set-Service -Name VSS -StartupType Manual
    Write-Host "    REMEDIATED: VSS service re-enabled (Manual)" -ForegroundColor Yellow
}

# 2. Check controlled folder access (ransomware protection) state
$asr = Get-MpPreference -ErrorAction SilentlyContinue
$cfa = $asr.EnableControlledFolderAccess
Write-Host "[2] Controlled Folder Access state: $cfa (1=Enabled, 2=Audit, 0=Disabled)"
if ($Remediate -and $cfa -ne 1) {
    Set-MpPreference -EnableControlledFolderAccess Enabled
    Write-Host "    REMEDIATED: Controlled Folder Access enabled" -ForegroundColor Yellow
    Write-Host "    NOTE: Add LOB application exclusions to avoid breakage" -ForegroundColor Yellow
}

# 3. Verify attack surface reduction rules for common ransomware vectors
$asrRules = @{
    '56a863a9-875e-4185-98a7-b882c64b5ce5' = 'Block abuse of exploited vulnerable signed drivers'
    '7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c' = 'Block Adobe Reader child processes'
    'be9ba2d9-53ea-4cdc-84e5-9b1eeee46550' = 'Block executable content from email/webmail'
    'd4f940ab-401b-4efc-aadc-ad5f3c50688a' = 'Block Office apps from creating child processes'
    'c1db55ab-c21a-4637-bb3f-a12568109d35' = 'Use advanced ransomware protection'
}
Write-Host "[3] ASR Rule Status:"
foreach ($rule in $asrRules.GetEnumerator()) {
    $idx = [array]::IndexOf($asr.AttackSurfaceReductionRules_Ids, $rule.Key)
    $state = if ($idx -ge 0) { $asr.AttackSurfaceReductionRules_Actions[$idx] } else { 'Not configured' }
    Write-Host "    $($rule.Value): $state (0=Off, 1=Block, 2=Audit)"
}

# 4. Audit for exposed SMBv1 and unsigned/RDP risk
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
Write-Host "[4] SMBv1 state: $($smb1.State) (should be Disabled)"
if ($Remediate -and $smb1.State -eq 'Enabled') {
    Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
    Write-Host "    REMEDIATED: SMBv1 disabled (restart required)" -ForegroundColor Yellow
}

# 5. Flag recent shadow deletion events in the last 72 hours
$cutoff = (Get-Date).AddHours(-72)
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,7040; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Volume Shadow Copy' }
Write-Host "[5] VSS service state changes (72h): $($vssEvents.Count)"
if ($vssEvents) { Write-Host "    WARNING: Investigate VSS service manipulation" -ForegroundColor Red }

Write-Host "=== Audit Complete ===" -ForegroundColor Cyan