Signature Healthcare Ransomware Incident: EHR Availability Defense & Clinical System Protection

---
title: Potential Ransomware Preparation - Shadow Copy Deletion
id: 8f2c3b1e-5d4e-4a8b-9f1c-2d3e4a5f6b7c
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin or wmic, a common precursor to ransomware execution to prevent recovery.
references:
 - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.impact
 - attack.t1490
logsource:
 category: process_creation
 product: windows
detection:
 selection_vssadmin:
   Image|endswith: '\vssadmin.exe'
   CommandLine|contains: 'delete shadows'
 selection_wmic:
   Image|endswith: '\wmic.exe'
   CommandLine|contains: 'shadowcopy'
   CommandLine|contains: 'delete'
 condition: 1 of selection_*
falsepositives:
 - Legitimate system administration tasks (rare)
level: high
---
title: Ransomware - Mass File Encryption via PowerShell
id: 9a1d2c3e-4b5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential ransomware activity characterized by rapid file encryption or deletion attempts via PowerShell scripts.
references:
 - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.impact
 - attack.t1486
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith: '\powershell.exe'
   CommandLine|contains:
     - 'Encrypt-'
     - 'Remove-Item'
     - '-Recurse'
     - '-Force'
   CommandLine|contains:
     - '*.pdf'
     - '*.doc'
     - '*.db'
     - '*.bak'
 condition: selection
falsepositives:
 - Legitimate system cleanup scripts
level: critical

// Hunt for Shadow Copy Deletion and subsequent file encryption activity
let ProcessEvents = DeviceProcessEvents
| where Timestamp > ago(24h);
let ShadowCopyDeletion = ProcessEvents
| where FileName in ('vssadmin.exe', 'wmic.exe')
| where ProcessCommandLine has 'delete' and (ProcessCommandLine has 'shadow' or ProcessCommandLine has 'shadowcopy');
let MassEncryption = ProcessEvents
| where FileName in ('powershell.exe', 'cmd.exe', 'rundll32.exe')
| where ProcessCommandLine has any('.encrypted', '.locked', '.crypto', 'Remove-Item')
| summarize count() by DeviceName, bin(Timestamp, 1m)
| where count_ > 50;
union ShadowCopyDeletion, MassEncryption
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, ActionType

-- Hunt for ransomware notes and encrypted file extensions on critical drives
SELECT FullPath, Size, Mtime
FROM glob(globs='/*\*.locked', root='C:\')
WHERE NOT IsDir
LIMIT 50
UNION ALL
SELECT FullPath, Size, Mtime
FROM glob(globs='/*\readme*.txt', root='C:\Users\Public\')
WHERE Mtime > now() - 24h
-- Note: Adjust root paths to match your EHR/Pharmacy data drives (e.g., D:\, E:\)

# Clinical System Ransomware Triage Script
Write-Host "[+] Starting Triage for Clinical Systems..." -ForegroundColor Cyan

# 1. Check for VSS Service Status (Should be Running)
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne 'Running') {
    Write-Host "[!] ALERT: Volume Shadow Copy Service is not running! Status: $($vssService.Status)" -ForegroundColor Red
} else {
    Write-Host "[+] VSS Service Status: $($vssService.Status)" -ForegroundColor Green
}

# 2. Scan for common ransomware extensions in EHR Data Directories (Modify path as needed)
$targetDirs = @("C:\", "D:\", "E:\") # Add specific EHR data paths
$suspiciousExtensions = @("*.locked", "*.encrypted", "*.crypt", "*.cryptolocker", "*.pulsed1")

foreach ($dir in $targetDirs) {
    if (Test-Path $dir) {
        Write-Host "[+] Scanning $dir for ransomware extensions..." -ForegroundColor Yellow
        $found = $false
        foreach ($ext in $suspiciousExtensions) {
            $files = Get-ChildItem -Path $dir -Filter $ext -Recurse -ErrorAction SilentlyContinue -Depth 2
            if ($files) {
                Write-Host "[!] CRITICAL: Found files with extension $ext in $dir" -ForegroundColor Red
                $files | Select-Object -First 5 FullName, LastWriteTime | Format-List
                $found = $true
            }
        }
        if (-not $found) { Write-Host "[+] No suspicious extensions found in $dir" -ForegroundColor Green }
    }
}

# 3. Check for recent creation of Ransom notes (e.g., README files)
Write-Host "[+] Checking for ransom notes in User Profiles..." -ForegroundColor Yellow
$notes = Get-ChildItem -Path "C:\Users\Public\" -Filter "*readme*.txt" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
if ($notes) {
    Write-Host "[!] ALERT: Potential ransom notes found recently!" -ForegroundColor Red
    $notes | Format-List FullName, LastWriteTime
} else {
    Write-Host "[+] No recent ransom notes detected." -ForegroundColor Green
}