Ransomware Threat Intelligence: How Defenders Track Adversary Infrastructure and Stop Encryption Attacks Before Detonation

---
title: Ransomware Shadow Copy Deletion via vssadmin wmic or PowerShell
id: 3f9c1a72-8b2d-4e61-a5c4-7d8e9f0a1b2c
status: experimental
description: Detects deletion or resizing of volume shadow copies, a near-universal ransomware precursor behavior used to destroy recovery options before encryption.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.recordedfuture.com/blog/ransomware-threat-intelligence
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete shadow'
      - 'resize shadowstorage'
      - 'Remove-WmiObject win32_shadowcopy'
  condition: all of selection_*
falsepositives:
  - Backup administrators performing storage maintenance
  - Legitimate VSS troubleshooting
level: high
---
title: Ransomware Boot Recovery and Backup Service Tampering
id: 8c2e5b41-6f3a-4d79-b1e8-2a4c6d8f0e1a
status: experimental
description: Detects bcdedit recovery tampering and mass stopping of backup/database services, consistent with ransomware pre-encryption staging observed across RaaS affiliates.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1489/
  - https://www.recordedfuture.com/blog/ransomware-threat-intelligence
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_net:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
    CommandLine|contains:
      - 'stop'
      - 'disable'
    CommandLine|contains:
      - 'veeam'
      - 'backup'
      - 'vss'
      - 'sql'
      - 'mssql'
      - 'exchange'
      - 'sophos'
  condition: selection_bcd or selection_net
falsepositives:
  - System administrators modifying boot configuration
  - Scheduled backup maintenance windows
level: high
---
title: Rclone or Cloud Sync Tool Execution from Non-Standard Path
id: 5d7a3f19-2e8c-4b45-9a1d-6c3e8f2b4a7d
status: experimental
description: Detects execution of rclone or similar exfiltration tooling from user-writable or temp paths, a common ransomware double-extortion staging behavior for data theft before encryption.
references:
  - https://attack.mitre.org/techniques/T1567.002/
  - https://www.recordedfuture.com/blog/ransomware-threat-intelligence
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    - Image|endswith:
        - '\rclone.exe'
        - '\megacmd.exe'
        - '\winscp.com'
        - '\winscp.exe'
    - OriginalFileName:
        - 'rclone.exe'
  selection_path:
    Image|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: all of selection_*
falsepositives:
  - IT teams using rclone for legitimate cloud migration (whitelist approved paths)
level: medium

// Hunt: Ransomware pre-encryption staging behaviors across the estate
let lookback = 7d;
let shadowKill = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
        or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
        or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("win32_shadowcopy", "delete shadows"))
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
    | project ShadowKillTime=TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine;
let massRename = DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where ActionType == "FileRenamed"
    | summarize RenameCount=count(), DistinctExtensions=dcount(tostring(split(FileName, ".")[-1])), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(TimeGenerated, 5m)
    | where RenameCount > 100 and DistinctExtensions > 10;
shadowKill
| join kind=inner massRename on DeviceName
| where FirstSeen > ShadowKillTime
| project ShadowKillTime, FirstSeen, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, RenameCount, DistinctExtensions
| order by ShadowKillTime asc

// Correlate outbound connections against ingested ransomware C2 threat intelligence
let lookback = 14d;
let ransomwareIOC = ThreatIntelligenceIndicator
    | where TimeGenerated > ago(lookback)
    | where isnotempty(NetworkIP) or isnotempty(NetworkDestinationIP) or isnotempty(DomainName)
    | where Description has_any ("ransomware", "cobalt", "sliver", "brute ratel", "lockbit", "blackcat", "akira", "play")
        or ThreatType has "c2"
    | extend IOC_IP = coalesce(NetworkIP, NetworkDestinationIP), IOC_Domain = DomainName;
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| join kind=inner (ransomwareIOC | where isnotempty(IOC_IP) | project IOC_IP, Description) on $left.RemoteIP == $right.IOC_IP
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, Description
| order by TimeGenerated desc

-- Ransomware staging sweep: anti-recovery processes, suspicious execution paths, and ransom note artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       'Anti-Recovery Process' AS Indicator
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|resize shadowstorage)'

UNION ALL

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       'LOLBIN from User-Writable Path' AS Indicator
FROM pslist()
WHERE Exe =~ '(?i)(appdata|temp|programdata|users\\\\public)'
  AND Name =~ '(?i)(rundll32|regsvr32|mshta|powershell|rclone|psexec)'

UNION ALL

SELECT 0 AS Pid, 0 AS Ppid, Name, FullPath AS CommandLine, FullPath AS Exe,
       'N/A' AS Username, Mtime AS CreateTime, 'Ransom Note Artifact' AS Indicator
FROM glob(globs=['C:/Users/*/Desktop/*READ*ME*.txt',
                 'C:/Users/*/Documents/*RECOVER*FILES*.txt',
                 'C:/Users/*/Desktop/*DECRYPT*.html',
                 'C:/ProgramData/*HOW*TO*RESTORE*.txt'])
WHERE Mtime > Now() - 604800

# Security Arsenal - Ransomware Pre-Encryption Hardening Verification
# Run as Administrator. Review ASR rules in Audit mode before switching to Block.

# 1. Verify VSS is operational and shadow copies exist (ransomware targets these first)
Write-Host "[+] Checking Volume Shadow Copy service and existing shadows..." -ForegroundColor Cyan
$vss = Get-Service VSS
if ($vss.StartType -eq 'Disabled') {
    Set-Service VSS -StartupType Manual
    Write-Warning "VSS was disabled - re-enabled to Manual (default). Investigate why it was disabled."
}
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Warning "No shadow copies present. Creating baseline restore point."
    Checkpoint-Computer -Description "Pre-Hardening Baseline" -RestorePointType "MODIFY_SETTINGS"
}

# 2. Verify Microsoft Defender Tamper Protection (ransomware crews attempt to disable it)
$tamper = Get-MpComputerStatus
if (-not $tamper.IsTamperProtected) {
    Write-Warning "Tamper Protection is OFF. Enable via Microsoft Defender portal: Security > Manage tamper protection."
}

# 3. Deploy key Attack Surface Reduction rules targeting ransomware TTPs (start in Audit mode)
$asrRules = @{
    'e6db77e5-3df2-4cf1-b95a-636979351e5b' = 'Block persistence via WMI event subscription'
    'd1e49aac-8f56-4280-b9ba-993a6d77406c' = 'Block process creations from PSExec/WMI'
    'b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4' = 'Block untrusted/unsigned processes from USB'
    '92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b' = 'Block Win32 API calls from Office macros'
    'c1db55ab-c21a-4637-bb3f-a12568109d35' = 'Use advanced ransomware protection'
}
foreach ($rule in $asrRules.GetEnumerator()) {
    Set-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key -AttackSurfaceReductionRules_Actions AuditMode
    Write-Host "[+] ASR rule set to Audit: $($rule.Value)" -ForegroundColor Green
}

# 4. Block common exfil/staging tooling by hash-agnostic path policy (AppLocker stub)
Write-Host "[+] Review AppLocker/WDAC policy for rclone.exe, megacmd.exe in user-writable paths." -ForegroundColor Cyan

# 5. Audit: flag any account not enrolled in MFA with VPN/RDP access (credential-based initial access)
Write-Host "[+] Verify MFA enforcement on all remote access - infostealer credentials remain the #1 ransomware entry vector." -ForegroundColor Cyan

Write-Host "[+] Complete. Re-run in 7-14 days and convert ASR rules from Audit to Block after tuning." -ForegroundColor Green