Ryuk Encryption Attack: Guilty Plea Highlights Need for Detection and Hardening

---
title: Potential Ryuk Ransomware Activity - VSS Shadow Copy Deletion
id: 8a8c8c12-1d2b-4f3a-9c5e-6f7g8h9i0j1k
status: experimental
description: Detects the deletion of Volume Shadow Copies often performed by Ryuk prior to encryption using vssadmin.
references:
 - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/15
tags:
 - attack.impact
 - attack.t1490
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith: '\vssadmin.exe'
   CommandLine|contains: 'delete shadows'
 condition: selection
falsepositives:
 - Legitimate system administration (rare)
level: critical
---
title: Ryuk Ransomware Note Creation
id: b9d9d9e2-2e3c-5g4h-0d6f-1g2h3i4j5k6l
status: experimental
description: Detects the creation of RyukReadMe.txt or similar ransom note files in user directories.
references:
 - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/15
tags:
 - attack.impact
 - attack.t1486
logsource:
 category: file_create
 product: windows
detection:
 selection:
   TargetFilename|contains:
     - 'RyukReadMe.txt'
     - 'RyukRestore.txt'
 condition: selection
falsepositives:
 - None
level: high
---
title: Suspicious Process Execution from Temp Directory
id: c0e0e0f3-3f4d-6h5i-1e7g-2h3i4j5k6l7m
status: experimental
description: Detects execution of binaries from Temp directories, a common TTP for Ryuk payload staging.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/15
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|contains:
     - '\Windows\Temp\'
     - '\AppData\Local\Temp\'
 filter:
   Image|contains:
     - '\Windows\Temp\signtool.exe'
     - '\Windows\Temp\chrome_installer.exe'
 condition: selection and not filter
falsepositives:
 - Legitimate software installers
level: medium

// Hunt for VSS shadow copy deletion and suspicious parent processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessVersionInfoOriginalFileName =~ "vssadmin.exe" or FileName =~ "vssadmin.exe")
| where ProcessCommandLine has "delete" and ProcessCommandLine has "shadows"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend IoC = "VSS Deletion"
| union (
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FolderPath has "\\Windows\\Temp" or FolderPath has "\\AppData\\Local\\Temp"
  | where ProcessVersionInfoOriginalFileName !in ("signtool.exe", "msiexec.exe", "chrome_installer.exe")
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
  | extend IoC = "Suspicious Temp Exec"
)

-- Hunt for Ryuk ransom notes and suspicious executables in temp folders
SELECT 
  FullPath, 
  Size, 
  Mtime, 
  Mode
FROM glob(globs="\\Users\\*\\Desktop\\*Ryuk*.txt", root=pathspec("C:"))
UNION
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe
FROM pslist()
WHERE Exe =~ "C:\\Windows\\Temp\\.*" 
   OR Exe =~ "C:\\Users\\.*\\AppData\\Local\\Temp\\.*"

# Remediation script to isolate host and hunt for Ryuk artifacts
# Requires Administrator privileges

Write-Host "[+] Starting Ryuk Incident Response Protocol..." -ForegroundColor Cyan

# 1. Isolate the host (Disable network interfaces)
Write-Host "[!] Isolating host by disabling network adapters..." -ForegroundColor Yellow
Get-NetAdapter | Where-Object {$_.Status -eq "Up"} | Disable-NetAdapter -Confirm:$false

# 2. Kill suspicious processes (e.g., common Ryuk executable patterns)
Write-Host "[!] Terminating suspicious processes..." -ForegroundColor Yellow
$suspiciousProcesses = @("*WindowsUpdate.exe", "*Ryuk*")
foreach ($proc in Get-Process) {
    foreach ($pattern in $suspiciousProcesses) {
        if ($proc.ProcessName -like $pattern) {
            try {
                Stop-Process -Id $proc.Id -Force -ErrorAction Stop
                Write-Host "[+] Killed process:" $proc.ProcessName -ForegroundColor Green
            } catch {
                Write-Host "[-] Failed to kill process:" $proc.ProcessName -ForegroundColor Red
            }
        }
    }
}

# 3. Scan for Ransom Notes
Write-Host "[*] Scanning for Ransom Notes..." -ForegroundColor Cyan
$notes = Get-ChildItem -Path C:\Users\ -Recurse -Filter "*Ryuk*" -ErrorAction SilentlyContinue
if ($notes) {
    Write-Host "[!] FOUND RANSOM NOTES:" -ForegroundColor Red
    $notes.FullName
} else {
    Write-Host "[+] No Ryuk notes found." -ForegroundColor Green
}

Write-Host "[-] Machine isolated. Do not reconnect to network until forensic image is acquired." -ForegroundColor Red