UNM Health Ransomware Attack: Emergency Response Guide for Healthcare Organizations

---
title: Ransomware Shadow Copy Deletion via vssadmin or WMIC
id: a8c5d1e2-4f3b-4e6a-9c1d-2b7f8e5a3d9c
status: experimental
description: Detects deletion of Volume Shadow Copies, a common ransomware precursor to prevent system recovery. Frequently observed before mass encryption in healthcare ransomware incidents.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'shadowcopy delete /nointeractive'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - 'Delete()'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup software performing shadow copy cleanup
  - System administrators performing maintenance during approved change windows
level: high
---
title: Mass File Encryption Behavior - Suspicious File Extension Modifications
id: b2d4e7f9-1a3c-4e8b-9d2f-5c6a7e8b9d1f
status: experimental
description: Detects mass file renaming operations with suspicious extensions characteristic of ransomware encryption. Monitors for bulk modification of clinical documents, databases, and medical imaging files.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_rename
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.crypto'
      - '.crypt'
      - '.enc'
      - '.lockbit'
      - '.blackcat'
      - '.akira'
      - '.play'
  filter_clinical_files:
    SourceFilename|endswith:
      - '.dcm'
      - '.pdf'
      - '.doc'
      - '.docx'
      - '.xls'
      - '.xlsx'
      - '.mdf'
      - '.ldf'
      - '.bak'
  condition: selection and filter_clinical_files
falsepositives:
  - Legitimate file encryption software used for compliance purposes
  - Medical imaging archive systems with custom file handling
level: critical
---
title: Suspicious PowerShell Execution from Clinical Workstations
id: c7e9a1d3-5b2f-4d8e-a6c9-1f3e5b7d9a2c
status: experimental
description: Detects encoded or obfuscated PowerShell commands commonly used in ransomware staging and execution. Clinical workstations typically do not require PowerShell for routine operations.
references:
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_suspicious:
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - '-e '
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'Net.WebClient'
      - 'hidden'
      - '-w hidden'
      - '-windowstyle hidden'
  selection_bypass:
    CommandLine|contains:
      - '-ep bypass'
      - '-executionpolicy bypass'
      - 'bypass -nop'
  condition: selection_img and (selection_suspicious or selection_bypass)
falsepositives:
  - Legitimate administrative scripts from IT department
  - Clinical application installers that use PowerShell
level: high

// Hunt 1: Shadow Copy Deletion Across Clinical Infrastructure
// Detects ransomware preparation activity targeting backup/recovery mechanisms
let TimeRange = 7d;
union isfuzzy=true
    (SecurityEvent
    | where TimeGenerated > ago(TimeRange)
    | where EventID == 4688
    | where Process has_any ("vssadmin.exe", "wmic.exe", "powershell.exe", "pwsh.exe")
    | where CommandLine has_any ("delete shadows", "shadowcopy delete", "Win32_Shadowcopy", "Delete()")
    | project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName
    | extend DetectionSource = "SecurityEvent"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(TimeRange)
    | where FileName in~ ("vssadmin.exe", "wmic.exe", "powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "Win32_Shadowcopy", "Delete()")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend DetectionSource = "Defender")
| extend ClinicalContext = case(
    Computer has_any ("EHR", "CPOE", "PACS", "LIS", "RAD", "CLIN") or DeviceName has_any ("EHR", "CPOE", "PACS", "LIS", "RAD", "CLIN"), "HIGH - Clinical System",
    Computer has_any ("MED", "NURSE", "DOC", "OR", "ER", "ICU") or DeviceName has_any ("MED", "NURSE", "DOC", "OR", "ER", "ICU"), "HIGH - Patient Care Area",
    "MEDIUM - Administrative")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), EventCount = count() by Computer, Account, Process, CommandLine, ClinicalContext, DetectionSource
| order by ClinicalContext asc, EventCount desc

// Hunt 2: Mass File Encryption - Extension Modification Patterns
// Detects bulk file renaming with ransomware extensions on clinical systems
let TimeRange = 24h;
let RansomwareExtensions = dynamic([".encrypted", ".locked", ".crypto", ".crypt", ".enc", ".lockbit", ".blackcat", ".akira", ".play", ".ryuk", ".maze", ".conti"]);
DeviceFileEvents
| where TimeGenerated > ago(TimeRange)
| where ActionType == "FileRenamed"
| extend Extension = tolower(strcat(".", split(FileName, ".")[-1]))
| where Extension in (RansomwareExtensions)
| extend ClinicalFileType = case(
    PreviousFileName endswith ".dcm", "DICOM Medical Imaging",
    PreviousFileName has_any (".pdf", ".doc", ".docx", ".xls", ".xlsx"), "Clinical Documentation",
    PreviousFileName has_any (".mdf", ".ldf", ".bak"), "Database Files",
    "Other")
| summarize EncryptedFileCount = count(), FileTypes = make_set(ClinicalFileType), Extensions = make_set(Extension) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where EncryptedFileCount > 10
| extend ThreatLevel = case(
    EncryptedFileCount > 100, "CRITICAL - Mass Encryption",
    EncryptedFileCount > 50, "HIGH - Active Encryption",
    "MEDIUM - Suspicious Activity")
| order by EncryptedFileCount desc

// Hunt 3: Suspicious PowerShell from Clinical Workstations
// Detects encoded/obfuscated PowerShell execution in patient care areas
let TimeRange = 7d;
let ClinicalWorkstations = dynamic(["NURSE", "MED", "CLIN", "OR", "ER", "ICU", "RAD", "LAB"]);
union isfuzzy=true
    (SecurityEvent
    | where TimeGenerated > ago(TimeRange)
    | where EventID == 4688
    | where Process has_any ("powershell.exe", "pwsh.exe")
    | where CommandLine has_any ("-enc", "-encodedcommand", "IEX", "Invoke-Expression", "DownloadString", "bypass", "hidden")
    | where Computer has_any (ClinicalWorkstations)
    | project TimeGenerated, Computer, Account, CommandLine, ParentProcessName
    | extend Source = "SecurityEvent"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(TimeRange)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("-enc", "-encodedcommand", "IEX", "Invoke-Expression", "DownloadString", "bypass", "hidden")
    | where DeviceName has_any (ClinicalWorkstations)
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
    | extend Source = "Defender")
| summarize FirstExecution = min(TimeGenerated), ExecutionCount = count(), Commands = make_set(CommandLine, 5) by Computer, Account, ParentProcessName, Source
| where ExecutionCount < 100  // Filter out known automated processes
| extend RiskScore = case(
    Commands has "DownloadString", 90,
    Commands has_any ("-enc", "-encodedcommand"), 75,
    Commands has "bypass", 60,
    40)
| order by RiskScore desc

-- Healthcare Ransomware Hunt: Process Execution + File System Artifacts
-- Run against clinical workstations, EHR servers, and medical device management systems

LET suspicious_processes = pslist()
WHERE Name =~ '(?i)(vssadmin|wmic|powershell|pwsh)\.exe'
  AND CommandLine =~ '(?i)(delete shadows|shadowcopy delete|-enc|-encodedcommand|IEX|bypass|hidden)'

LET encrypted_files = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/**/*.encrypted',
  'C:/Users/**/*.locked',
  'C:/Users/**/*.crypto',
  'D:/Shares/**/*.encrypted',
  'E:/ClinicalData/**/*.locked',
  'F:/MedicalRecords/**/*.crypt'
])

LET suspicious_network = netstat()
WHERE State =~ 'ESTABLISHED'
  AND (RemoteAddress =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)' = FALSE)
  AND Process =~ '(?i)(powershell|wmic|psexec|rundll32|regsvr32)\.exe'

SELECT 
  'Process' AS ArtifactType,
  Pid,
  Name,
  CommandLine,
  Exe,
  Username,
  CreateTime,
  NULL AS FilePath,
  NULL AS RemoteIP
FROM suspicious_processes

UNION ALL

SELECT 
  'EncryptedFile' AS ArtifactType,
  NULL AS Pid,
  NULL AS Name,
  NULL AS CommandLine,
  NULL AS Exe,
  NULL AS Username,
  Mtime AS CreateTime,
  FullPath AS FilePath,
  NULL AS RemoteIP
FROM encrypted_files

UNION ALL

SELECT 
  'NetworkConnection' AS ArtifactType,
  Pid,
  Process AS Name,
  NULL AS CommandLine,
  NULL AS Exe,
  NULL AS Username,
  NULL AS CreateTime,
  LocalAddress AS FilePath,
  RemoteAddress AS RemoteIP
FROM suspicious_network

# Healthcare Ransomware Hardening Script - Clinical Workstations
# Run with elevated privileges on Windows systems
# Test in non-production environment first

Write-Host "=== Healthcare Ransomware Hardening Script ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan

# 1. Enable and Protect Volume Shadow Copies
Write-Host "`n[1] Configuring Volume Shadow Copy protection..." -ForegroundColor Yellow
try {
    # Ensure VSS service is running
    Set-Service -Name VSS -StartupType Automatic -ErrorAction Stop
    Start-Service -Name VSS -ErrorAction Stop
    
    # Create shadow copies for all fixed drives
    $drives = Get-WmiObject Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3}
    foreach ($drive in $drives) {
        $driveLetter = $drive.DeviceID
        Write-Host "  Creating shadow copy for $driveLetter" -ForegroundColor Green
        (Get-WmiObject -List Win32_ShadowCopy).Create($driveLetter + "\", "ClientAccessible")
    }
    
    # Disable vssadmin delete capability (requires manual approval to re-enable)
    $vssadminPath = "$env:SystemRoot\System32\vssadmin.exe"
    if (Test-Path $vssadminPath) {
        # Create registry key to log vssadmin usage
        New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exe" -Force -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exe" -Name "Debugger" -Value "C:\Windows\System32\systray.exe" -ErrorAction SilentlyContinue
        Write-Host "  VSSAdmin deletion protection enabled" -ForegroundColor Green
    }
} catch {
    Write-Warning "  Error configuring VSS: $_"
}

# 2. Disable Windows Script Host and PowerShell v2 (common ransomware vectors)
Write-Host "`n[2] Disabling legacy scripting engines..." -ForegroundColor Yellow
try {
    # Disable Windows Script Host
    New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" -Force -ErrorAction SilentlyContinue | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" -Name "Enabled" -Value 0 -ErrorAction Stop
    Write-Host "  Windows Script Host disabled" -ForegroundColor Green
    
    # Disable PowerShell v2
    $psv2 = Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 -ErrorAction SilentlyContinue
    if ($psv2.State -eq "Enabled") {
        Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 -NoRestart -ErrorAction Stop
        Write-Host "  PowerShell v2 disabled" -ForegroundColor Green
    }
} catch {
    Write-Warning "  Error disabling scripting engines: $_"
}

# 3. Enable PowerShell Script Block Logging and Module Logging
Write-Host "`n[3] Enabling PowerShell enhanced logging..." -ForegroundColor Yellow
try {
    $psLoggingPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
    New-Item -Path $psLoggingPath -Force -ErrorAction SilentlyContinue | Out-Null
    Set-ItemProperty -Path $psLoggingPath -Name "EnableScriptBlockLogging" -Value 1 -ErrorAction Stop
    
    $psModulePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
    New-Item -Path $psModulePath -Force -ErrorAction SilentlyContinue | Out-Null
    Set-ItemProperty -Path $psModulePath -Name "EnableModuleLogging" -Value 1 -ErrorAction Stop
    
    Write-Host "  PowerShell logging enabled" -ForegroundColor Green
} catch {
    Write-Warning "  Error enabling PowerShell logging: $_"
}

# 4. Disable Office Macros by Default (common initial access vector)
Write-Host "`n[4] Hardening Microsoft Office macro settings..." -ForegroundColor Yellow
try {
    $officeVersions = @("16.0", "15.0", "14.0")  # Office 2016/365, 2013, 2010
    foreach ($version in $officeVersions) {
        $macroPath = "HKCU:\Software\Policies\Microsoft\Office\$version\Word\Security"
        New-Item -Path $macroPath -Force -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty -Path $macroPath -Name "VBAWarnings" -Value 4 -ErrorAction SilentlyContinue  # Disable all macros
        
        $excelPath = "HKCU:\Software\Policies\Microsoft\Office\$version\Excel\Security"
        New-Item -Path $excelPath -Force -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty -Path $excelPath -Name "VBAWarnings" -Value 4 -ErrorAction SilentlyContinue
    }
    Write-Host "  Office macros disabled by policy" -ForegroundColor Green
} catch {
    Write-Warning "  Error hardening Office: $_"
}

# 5. Enable Controlled Folder Access (ransomware protection)
Write-Host "`n[5] Enabling Controlled Folder Access..." -ForegroundColor Yellow
try {
    Set-MpPreference -EnableControlledFolderAccess Enabled -ErrorAction Stop
    
    # Add clinical data folders to protected list
    $protectedFolders = @(
        "C:\ClinicalData",
        "C:\MedicalRecords",
        "D:\PatientData",
        "E:\EHR",
        "$env:USERPROFILE\Documents",
        "$env:USERPROFILE\Desktop"
    )
    
    foreach ($folder in $protectedFolders) {
        if (Test-Path $folder) {
            Add-MpPreference -ControlledFolderAccessProtectedFolders $folder -ErrorAction SilentlyContinue
        }
    }
    Write-Host "  Controlled Folder Access enabled with clinical data protection" -ForegroundColor Green
} catch {
    Write-Warning "  Error enabling Controlled Folder Access: $_"
}

# 6. Audit and Disable SMBv1 (lateral movement vector)
Write-Host "`n[6] Checking SMBv1 status..." -ForegroundColor Yellow
try {
    $smbv1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
    if ($smbv1.EnableSMB1Protocol -eq $true) {
        Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force -ErrorAction Stop
        Write-Host "  SMBv1 disabled" -ForegroundColor Green
    } else {
        Write-Host "  SMBv1 already disabled" -ForegroundColor Green
    }
} catch {
    Write-Warning "  Error checking SMBv1: $_"
}

# 7. Create Ransomware Canary Files
Write-Host "`n[7] Deploying ransomware canary files..." -ForegroundColor Yellow
try {
    $canaryLocations = @(
        "$env:USERPROFILE\Documents",
        "$env:PUBLIC\Documents",
        "C:\Shares",
        "D:\ClinicalData"
    )
    
    $canaryNames = @(
        "zzz_passwords.txt",
        "zzz_backup_info.docx",
        "zzz_financial_data.xlsx",
        "aaa_important.pdf"
    )
    
    foreach ($location in $canaryLocations) {
        if (Test-Path $location) {
            foreach ($canary in $canaryNames) {
                $canaryPath = Join-Path $location $canary
                if (-not (Test-Path $canaryPath)) {
                    "CANARY FILE - DO NOT MODIFY - Security Monitoring" | Out-File -FilePath $canaryPath -ErrorAction SilentlyContinue
                    $file = Get-Item $canaryPath
                    $file.Attributes = 'Hidden,System'
                    Write-Host "  Created canary: $canaryPath" -ForegroundColor Green
                }
            }
        }
    }
    Write-Host "  Canary files deployed. Monitor for modifications." -ForegroundColor Yellow
} catch {
    Write-Warning "  Error creating canary files: $_"
}

# 8. Verify Windows Defender is Running and Updated
Write-Host "`n[8] Verifying Windows Defender status..." -ForegroundColor Yellow
try {
    $defenderStatus = Get-MpComputerStatus
    if ($defenderStatus.AntivirusEnabled -and $defenderStatus.RealTimeProtectionEnabled) {
        Write-Host "  Windows Defender is active" -ForegroundColor Green
        
        # Update definitions
        Update-MpSignature -ErrorAction Stop
        Write-Host "  Antivirus definitions updated" -ForegroundColor Green
        
        # Check definition age
        $definitionAge = (New-TimeSpan -Start $defenderStatus.AntivirusSignatureLastUpdated -End (Get-Date)).Days
        if ($definitionAge -gt 3) {
            Write-Warning "  Definition updates are $definitionAge days old!"
        }
    } else {
        Write-Warning "  Windows Defender is NOT properly configured!"
    }
} catch {
    Write-Warning "  Error checking Windows Defender: $_"
}

# 9. Audit Administrative Shares and Disable if Not Needed
Write-Host "`n[9] Auditing administrative shares..." -ForegroundColor Yellow
try {
    $adminShares = Get-SmbShare | Where-Object {$_.Name -match '^(ADMIN\$|C\$|D\$|E\$|IPC\$)'}
    Write-Host "  Current administrative shares:" -ForegroundColor Cyan
    $adminShares | Format-Table Name, Path, Description
    
    Write-Host "  Consider disabling administrative shares if not required for management" -ForegroundColor Yellow
    Write-Host "  Command: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'AutoShareWks' -Value 0" -ForegroundColor Cyan
} catch {
    Write-Warning "  Error auditing shares: $_"
}

# 10. Generate Summary Report
Write-Host "`n[10] Generating hardening summary..." -ForegroundColor Yellow
$reportPath = "$env:TEMP\RansomwareHardening_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"

$report = @"
Healthcare Ransomware Hardening Report
Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
Computer: $env:COMPUTERNAME
Domain: $env:USERDOMAIN

=== Configuration Summary ===
Volume Shadow Copies: Configured and Protected
Windows Script Host: Disabled
PowerShell v2: Disabled
PowerShell Logging: Enabled
Office Macros: Disabled by Policy
Controlled Folder Access: Enabled
SMBv1: Disabled
Canary Files: Deployed
Windows Defender: $(if((Get-MpComputerStatus).AntivirusEnabled){"Active"}else{"INACTIVE - CRITICAL"})

=== Critical Recommendations ===
1. Verify offline/immutable backups exist and are tested
2. Implement network segmentation between clinical and administrative systems
3. Enable MFA for all remote access (VPN, RDP, web portals)
4. Deploy EDR with ransomware-specific behavioral analytics
5. Establish 24/7 SOC monitoring or MDR service
6. Test incident response plan with clinical leadership
7. Patch all internet-facing systems immediately
8. Audit third-party vendor access and connections

=== Next Steps ===
- Review and test clinical application compatibility with hardening changes
- Document any applications requiring exceptions
- Schedule follow-up hardening for remaining systems
- Conduct tabletop exercise with clinical staff

"@

$report | Out-File -FilePath $reportPath -Force
Write-Host "  Report saved to: $reportPath" -ForegroundColor Green

Write-Host "`n=== Hardening Complete ===" -ForegroundColor Cyan
Write-Host "Review the report at: $reportPath" -ForegroundColor Yellow
Write-Host "IMPORTANT: Test all clinical applications after applying these changes" -ForegroundColor Red