Ryuk Affiliate Conviction: Active Defense Against Manual Big Game Hunting TTPs

---
title: Ryuk-style Shadow Copy Deletion via Vssadmin
id: 4a8b2c9d-1e3f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the deletion of system shadow copies using vssadmin, a common precursor to ransomware encryption to prevent recovery.
references:
 - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/05/20
tags:
 - attack.impact
 - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
falsepositives:
  - System administrators manually managing shadow storage (rare)
level: critical
---
title: Mass Service Termination via Net Stop
id: 5b9c3d0e-2f4a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects attempts to stop critical services (backup, AV, security) often seen in manual ransomware deployment.
references:
 - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/05/20
tags:
 - attack.impact
 - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
  selection_cli:
    CommandLine|contains: ' stop '
  selection_targets:
    CommandLine|contains:
      - 'backup'
      - 'sql'
      - 'exchange'
      - 'veeam'
      - 'vss'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative maintenance windows
level: high
---
title: Recovery Environment Modification via BCD Edit
id: 6c0d4e1f-3g5b-6c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects modification of boot configuration to disable recovery options, a technique used by Ryuk and successors to prevent safe mode recovery.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/20
tags:
 - attack.defense_evasion
 - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled No'
      - 'ignoreallfailures'
  condition: selection
falsepositives:
  - System boot configuration changes by IT staff
level: medium

// Hunt for Ryuk-style pre-encryption activity
// Looks for vssadmin deletion, service stopping, and bcdedit changes within a short timeframe
let TimeFrame = 1h;
let SuspiciousProcesses = 
  DeviceProcessEvents
  | where Timestamp > ago(TimeFrame)
  | where (FileName in~ ("vssadmin.exe", "bcdedit.exe") 
          or (FileName in~ ("net.exe", "net1.exe") and CommandLine has " stop "));
let ShadowCopyDeletion = 
  SuspiciousProcesses
  | where FileName == "vssadmin.exe" and CommandLine has "delete";
let ServiceStop = 
  SuspiciousProcesses
  | where FileName in~ ("net.exe", "net1.exe") 
  | where CommandLine has_any ("backup", "sql", "exchange", "veeam", "security");
let BootConfigEdit = 
  SuspiciousProcesses
  | where FileName == "bcdedit.exe" 
  | where CommandLine has_any ("recoveryenabled", "ignoreallfailures");
union ShadowCopyDeletion, ServiceStop, BootConfigEdit
| summarize count(), arg_max(Timestamp, *) by DeviceId, AccountName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessAccountName

-- Hunt for evidence of ransomware precursor activities
-- Targeting vssadmin usage, service termination, and recovery tampering
SELECT 
  Timestamp, 
  Username, 
  Name AS ProcessName, 
  CommandLine, 
  Exe
FROM process_scan(pslist())
WHERE 
  Name =~ 'vssadmin.exe' AND CommandLine =~ 'delete'
  OR Name =~ 'net.exe' AND CommandLine =~ 'stop' AND CommandLine =~ '(backup|sql|exchange|veeam)'
  OR Name =~ 'bcdedit.exe' AND CommandLine =~ '(recoveryenabled|ignoreallfailures)'
ORDER BY Timestamp DESC

<#
.SYNOPSIS
    Audit and Harden systems against Ransomware "Big Game Hunting" techniques.
.DESCRIPTION
    Checks for active RDP sessions (common lateral move vector), 
    ensures VSS service is running, and audits local administrators.
#>

Write-Host "[+] Starting Ransomware Hardening Audit..." -ForegroundColor Cyan

# 1. Audit Active RDP Sessions (Lateral Movement Check)
Write-Host "[*] Checking for active RDP sessions..." -ForegroundColor Yellow
$rdpSessions = query user | Select-Object -Skip 1
if ($rdpSessions) {
    Write-Host "[!] Active RDP sessions found. Verify these are authorized:" -ForegroundColor Red
    $rdpSessions
} else {
    Write-Host "[+] No active RDP sessions detected." -ForegroundColor Green
}

# 2. Ensure Volume Shadow Copy Service is Running (Recovery)
Write-Host "[*] Verifying VSS Service Status..." -ForegroundColor Yellow
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne 'Running') {
    Write-Host "[!] VSS Service is not running. Attempting to start..." -ForegroundColor Red
    try {
        Start-Service -Name VSS -ErrorAction Stop
        Write-Host "[+] VSS Service started successfully." -ForegroundColor Green
    } catch {
        Write-Host "[!] Failed to start VSS Service." -ForegroundColor Red
    }
} else {
    Write-Host "[+] VSS Service is running." -ForegroundColor Green
}

# 3. Audit Local Group Membership for Privilege Escalation paths
Write-Host "[*] Auditing Local Administrators group..." -ForegroundColor Yellow
$admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
Write-Host "[+] Current Local Administrators:" -ForegroundColor Green
foreach ($admin in $admins) {
    Write-Host ("    - {0} ({1})" -f $admin.Name, $admin.SID.Value)
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan