Supply Chain Under Siege: Detecting and Neutralizing Encryption-Based Attacks in Logistics

---
title: Potential Ransomware Activity - Shadow Copy Deletion via VSSAdmin
id: 859c36c4-3e3a-4e5b-9f9d-1a5c2b3d4e5f
status: experimental
description: Detects attempts to delete volume shadow copies, a common precursor to encryption to prevent recovery.
references:
 - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/10
tags:
 - attack.impact
 - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  condition: selection
falsepositives:
  - Legitimate system administration tasks (rare in production environments)
level: high
---
title: Suspicious WMIC Shadow Copy Deletion
id: 92b1f0c5-5a6d-4e8f-9a1c-2b3d4e5f6a7b
status: experimental
description: Detects the use of WMIC to delete shadow copies, often used when vssadmin is blocked or monitored.
references:
 - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/10
tags:
 - attack.impact
 - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      'shadowcopy'
      'delete'
  condition: selection
falsepositives:
  - Authorized system maintenance
level: high
---
title: Mass File Modification via PowerShell
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell scripts that may be encrypting files by iterating through directories.
references:
 - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/10
tags:
 - attack.impact
 - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Get-ChildItem'
      - '.Encrypt('
      - 'Invoke-AesEncryption'
  condition: selection
falsepositives:
  - Legitimate backup scripts or encryption utilities
level: medium

// Hunt for rapid mass file modifications indicative of encryption
// Adjust FileExtensionPattern to match known ransomware extensions if available
DeviceFileEvents
| where ActionType == "FileModified" or ActionType == "FileCreated"
| where Timestamp > ago(1h)
| summarize Count = count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath, bin(Timestamp, 5m)
| where Count > 50 // High threshold to detect bulk operations
| project DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath, Count, TimeWindow
| order by Count desc

-- Hunt for processes spawned from suspicious locations (AppData/Temp) that are writing to disk
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ 'C:\\Users\\.*\\AppData\\Local\\Temp\\.*exe'
   OR Exe =~ 'C:\\Users\\.*\\AppData\\Roaming\\.*exe'

-- Scan for common ransomware note extensions in user directories
SELECT FullPath, Mtime, Size
FROM glob(globs='C:\\Users\\*\\**/*.README*', root='/')
WHERE Size < 10240 // Ransom notes are usually small text files
LIMIT 100

# Audit Script: Check for Shadow Copy Health and Suspicious Processes
Write-Host "[+] Checking Volume Shadow Copy Service Status..."
$vss = Get-WmiObject -Class Win32_ShadowCopy | Measure-Object
if ($vss.Count -eq 0) {
    Write-Host "[!] WARNING: No Shadow Copies found. System may be vulnerable to ransomware data loss." -ForegroundColor Red
} else {
    Write-Host "[+] Shadow Copies present: $($vss.Count)" -ForegroundColor Green
}

# Check for processes executing from user profile temp directories (common ransomware dropper location)
Write-Host "[+] Scanning for suspicious process execution paths..."
$suspiciousProcs = Get-WmiObject Win32_Process | Where-Object { 
    $_.ExecutablePath -match 'AppData\\Local\\Temp' -or 
    $_.ExecutablePath -match 'AppData\\Roaming' -and 
    $_.Name -notin ('chrome.exe', 'firefox.exe', 'msedge.exe', 'teams.exe')
}

if ($suspiciousProcs) {
    Write-Host "[!] Suspicious processes detected:" -ForegroundColor Yellow
    $suspiciousProcs | ForEach-Object { Write-Host "Process: $($_.Name) | Path: $($_.ExecutablePath) | PID: $($_.ProcessId)" }
} else {
    Write-Host "[+] No immediately suspicious processes found in user temp directories." -ForegroundColor Green
}