Which SIEM platforms have a THREAT-Ransomware-StagingIndicators detection rule?

df00tech provides THREAT-Ransomware-StagingIndicators (Ransomware Pre-Deployment Staging Indicators) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-Ransomware-StagingIndicators detection?

The THREAT-Ransomware-StagingIndicators detection is rated critical severity with high confidence.

What are common false positives for THREAT-Ransomware-StagingIndicators?

Common false positives for THREAT-Ransomware-StagingIndicators include: Legitimate IT backup tools (Veeam, Acronis, Backup Exec) that use vssadmin to manage shadow copies; System administrators using net view/net share for legitimate inventory; PsExec used by IT staff for remote administration or software deployment during maintenance windows.

THREAT-Ransomware-StagingIndicators

Data Encrypted for Impact — Ransomware Pre-Deployment Staging Indicators

Q: What data sources are required to detect Ransomware Pre-Deployment Staging Indicators (THREAT-Ransomware-StagingIndicators)?

Detecting Ransomware Pre-Deployment Staging Indicators requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents), Sysmon, Windows Security Event Log.

Impact Discovery Lateral Movement Last updated: April 24, 2026

The hours before ransomware deployment follow a repeatable pattern regardless of group: network share enumeration, credential dumping, detection tool impairment, and staging of the ransomware binary in accessible locations. NCSC UK 2025 threat report identified Akira, Black Basta, and Play as the most active ransomware groups targeting UK SMBs. The staging sequence typically occurs within 1-48 hours before encryption begins, offering a detection opportunity. Key indicators: (1) net use or net share enumeration across the network; (2) vssadmin.exe or wmic delete shadowstorage (shadow copy deletion — the final indicator before encryption); (3) remote execution tool setup (PsExec, PAExec, WMI, WinRM) preparing for domain-wide payload deployment; (4) large file transfers or staging directories created; (5) AV/EDR impairment attempts. This detection targets the staging window before encryption — detection here prevents the actual ransomware event.

What is THREAT-Ransomware-StagingIndicators Ransomware Pre-Deployment Staging Indicators?

Ransomware Pre-Deployment Staging Indicators (THREAT-Ransomware-StagingIndicators) is a sub-technique of Data Encrypted for Impact (T1486) in the MITRE ATT&CK framework. It maps to the Impact and Discovery and Lateral Movement tactics — the adversary is trying to manipulate, interrupt, or destroy your systems and data.

This page provides production-ready detection logic for Ransomware Pre-Deployment Staging Indicators, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint (DeviceProcessEvents), Sysmon, Windows Security Event Log. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Impact Discovery Lateral Movement

Microsoft Sentinel / Defender

kusto

// THREAT: Ransomware Pre-Deployment Staging Indicators
// Detects the staging sequence used by Akira, Black Basta, LockBit, Play
// before mass ransomware deployment across the domain

// Indicator 1: Shadow copy deletion (T1490 — immediate escalation)
let ShadowDelete = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete", "resize", "shadowstorage"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("shadowcopy", "delete", "shadow"))
    or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Delete-ShadowCopy", "Win32_ShadowCopy", "vssadmin"))
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "no", "bootstatuspolicy", "ignoreallfailures"))
  )
| extend StageIndicator = "ShadowCopyDeletion"
| extend StagingRisk = 100;
// Indicator 2: Network share enumeration (mass reconnaissance)
let ShareEnum = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName =~ "net.exe" and ProcessCommandLine has_any ("view", "share", "use"))
    or (FileName =~ "net1.exe" and ProcessCommandLine has_any ("view", "share"))
    or (FileName =~ "netscan.exe")
    or (FileName =~ "AdFind.exe")
    or (FileName =~ "nltest.exe" and ProcessCommandLine has_any ("dclist", "domain_trusts", "server", "all_trusts"))
  )
| summarize EnumCount=count() by DeviceName, AccountName, bin(Timestamp, 15m)
| where EnumCount >= 5
| extend StageIndicator = "NetworkShareEnumeration"
| extend StagingRisk = 70;
// Indicator 3: Remote execution tools for mass deployment
let RemoteExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe")
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "/node:" and ProcessCommandLine has "process call create")
    or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Invoke-WMIMethod", "Invoke-Command", "New-PSSession")
        and ProcessCommandLine has_any ("-ComputerName", "-cn") and DeviceName != AccountDomain)
| extend StageIndicator = "RemoteExecutionToolUsed"
| extend StagingRisk = 80;
// Indicator 4: AV/EDR impairment (T1562.001)
let DefenseImpair = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName =~ "sc.exe" and ProcessCommandLine has_any ("stop", "delete", "config") and
     ProcessCommandLine has_any ("WinDefend", "Sense", "MpsSvc", "wscsvc", "WdFilter", "WdNisSvc",
        "SecurityHealthService", "SentinelAgent", "CSFalconService"))
    or (FileName =~ "taskkill.exe" and ProcessCommandLine has_any (
        "msmpeng", "mssense", "csagent", "sentinelagent", "cbdaemon", "mbam"))
    or (FileName =~ "reg.exe" and ProcessCommandLine has_any ("add", "delete") and
     ProcessCommandLine has_any ("WinDefend", "DisableAntiSpyware", "DisableRealtimeMonitoring",
        "SOFTWARE\\Policies\\Microsoft\\Windows Defender"))
  )
| extend StageIndicator = "DefenseImpairmentAttempt"
| extend StagingRisk = 90;
union ShadowDelete, RemoteExec, DefenseImpair
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, StageIndicator, StagingRisk
| sort by StagingRisk desc, Timestamp desc

Multi-indicator ransomware staging detection targeting the 1-48 hour pre-encryption window. Detects four key staging activities: shadow copy deletion (immediate escalation — encryption is imminent), network share enumeration (reconnaissance for deployment targets), remote execution tool setup (PsExec, WMI remoting for mass deployment), and AV/EDR impairment. StagingRisk score (70-100) indicates proximity to active ransomware deployment.

critical severity high confidence

Data Sources

Microsoft Defender for Endpoint (DeviceProcessEvents) Sysmon Windows Security Event Log

Required Tables

DeviceProcessEvents

False Positives

Legitimate IT backup tools (Veeam, Acronis, Backup Exec) that use vssadmin to manage shadow copies
System administrators using net view/net share for legitimate inventory
PsExec used by IT staff for remote administration or software deployment during maintenance windows
Endpoint management platforms (SCCM, Qualys, Tanium) that invoke WMI remote execution for patch deployment
Security testing by authorised penetration testers (shadow copy deletion should be excluded from scope)

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (
    (Image="*\\vssadmin.exe" AND (CommandLine="*delete*" OR CommandLine="*resize*" OR CommandLine="*shadowstorage*"))
    OR (Image="*\\wmic.exe" AND CommandLine="*shadowcopy*" AND CommandLine="*delete*")
    OR (Image="*\\bcdedit.exe" AND (CommandLine="*recoveryenabled*" OR CommandLine="*bootstatuspolicy*"))
  )
  OR
  (
    Image IN ("*\\psexec.exe", "*\\psexec64.exe", "*\\paexec.exe", "*\\remcom.exe")
  )
  OR
  (
    Image="*\\sc.exe" AND
    (CommandLine="*stop*" OR CommandLine="*delete*" OR CommandLine="*config*") AND
    (CommandLine="*WinDefend*" OR CommandLine="*Sense*" OR CommandLine="*MpsSvc*" OR
     CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*" OR CommandLine="*mbam*")
  )
  OR
  (
    Image="*\\taskkill.exe" AND
    (CommandLine="*msmpeng*" OR CommandLine="*mssense*" OR CommandLine="*csagent*" OR
     CommandLine="*sentinelagent*" OR CommandLine="*cbdaemon*")
  )
)
| eval StagingIndicator=case(
    match(Image, "(?i)vssadmin|bcdedit") OR (match(Image, "(?i)wmic") AND match(CommandLine, "(?i)shadowcopy.*delete")),
    "ShadowCopyDeletion_CRITICAL",
    match(Image, "(?i)(psexec|paexec|remcom)"),
    "RemoteExecTool_HIGH",
    match(Image, "(?i)sc\.exe") OR match(Image, "(?i)taskkill"),
    "DefenseImpairment_HIGH",
    true(), "Other_MEDIUM"
  )
| eval RiskScore=case(
    StagingIndicator="ShadowCopyDeletion_CRITICAL", 100,
    StagingIndicator="DefenseImpairment_HIGH", 90,
    StagingIndicator="RemoteExecTool_HIGH", 80,
    true(), 60
  )
| stats
    count AS EventCount,
    values(StagingIndicator) AS Indicators,
    values(CommandLine) AS Commands,
    max(RiskScore) AS MaxRisk,
    values(Image) AS Binaries
  BY host, User, _time span=30m
| eval ThreatActors="Akira, Black Basta, LockBit, Play, Medusa"
| sort - MaxRisk

SPL ransomware staging detection via Sysmon process creation. Covers all four staging indicator categories with a RiskScore-based prioritisation. Shadow copy deletion (RiskScore=100) indicates encryption is imminent; AV impairment (90) indicates active defense bypass in progress. Correlating multiple indicators from the same host in a 30-minute window is a high-confidence pre-ransomware indicator.

critical severity high confidence

Data Sources

Sysmon via Windows Event Log Windows Security Event Log

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Veeam or other backup tools managing VSS shadow copies
IT administrators using PsExec for remote administration tasks
Security tools stopping conflicting endpoint protection during upgrade

Elastic Security (EQL)

eql

any where event.category == "process" and event.type == "start" and (
  /* Shadow copy deletion - CRITICAL (T1490) */
  (process.name : "vssadmin.exe" and process.command_line : ("*delete*", "*shadowstorage*", "*resize*")) or
  (process.name : "wmic.exe" and process.command_line : "*shadowcopy*delete*") or
  (process.name : "bcdedit.exe" and process.command_line : ("*recoveryenabled*", "*bootstatuspolicy*", "*ignoreallfailures*")) or
  (process.name : "powershell.exe" and process.command_line : ("*Delete-ShadowCopy*", "*Win32_ShadowCopy*delete*", "*vssadmin*delete*")) or
  /* Remote execution tool staging - HIGH (T1021.002) */
  process.name : ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe") or
  (process.name : "wmic.exe" and process.command_line : "*/node:*" and process.command_line : "*process call create*") or
  /* Defense impairment - HIGH (T1562.001) */
  (
    process.name : "sc.exe" and
    process.command_line : ("*stop*", "*delete*", "*config*") and
    process.command_line : ("*WinDefend*", "*Sense*", "*MpsSvc*", "*SentinelAgent*", "*CSFalconService*", "*WdFilter*", "*WdNisSvc*", "*SecurityHealthService*")
  ) or
  (
    process.name : "taskkill.exe" and
    process.command_line : ("*msmpeng*", "*mssense*", "*csagent*", "*sentinelagent*", "*cbdaemon*", "*mbam*")
  ) or
  (
    process.name : "reg.exe" and
    process.command_line : ("*add*", "*delete*") and
    process.command_line : ("*DisableAntiSpyware*", "*DisableRealtimeMonitoring*", "*Windows Defender*", "*WinDefend*")
  )
)

Detects ransomware pre-deployment staging indicators across four behavioral axes using Elastic ECS process events: shadow copy deletion (T1490 — highest fidelity pre-encryption indicator, RiskScore 100), remote execution tool staging via PsExec/PAExec/RemCom (T1021.002, RiskScore 80), and defense impairment targeting Windows Defender and third-party EDR agents via sc.exe, taskkill, or reg.exe (T1562.001, RiskScore 90). Consistent with Akira, Black Basta, Play, and LockBit affiliate staging sequences observed by NCSC UK in 2025.

critical severity high confidence

Data Sources

Elastic Endpoint Security (elastic-agent) Windows Sysmon via Elastic Agent Fleet logs-endpoint.events.process-* (ECS process events)

Required Tables

logs-endpoint.events.process-* logs-windows.sysmon_operational-*

False Positives

Backup administrators running legitimate VSS snapshot management via vssadmin delete on dedicated backup servers as part of scheduled retention policy enforcement (Veeam, Commvault, Veritas agents)
IT operations teams using PsExec or PAExec for authorized remote software deployment, OS patch distribution, or incident response tasks across domain-joined endpoints during maintenance windows
Security platform migration projects that stop or disable incumbent AV/EDR services (WinDefend, Sense, legacy AV) using sc.exe before installing a replacement endpoint security stack

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  devicename AS ComputerName,
  username AS Username,
  QIDNAME(qid) AS EventName,
  LOGSOURCENAME(logsourceid) AS LogSource,
  CASE
    WHEN (
      (UTF8(payload) ILIKE '%vssadmin%' AND (UTF8(payload) ILIKE '%delete%' OR UTF8(payload) ILIKE '%shadowstorage%'))
      OR (UTF8(payload) ILIKE '%wmic%' AND UTF8(payload) ILIKE '%shadowcopy%' AND UTF8(payload) ILIKE '%delete%')
      OR (UTF8(payload) ILIKE '%bcdedit%' AND (UTF8(payload) ILIKE '%recoveryenabled%' OR UTF8(payload) ILIKE '%bootstatuspolicy%'))
      OR (UTF8(payload) ILIKE '%powershell%' AND (UTF8(payload) ILIKE '%Delete-ShadowCopy%' OR UTF8(payload) ILIKE '%Win32_ShadowCopy%delete%'))
    ) THEN 'ShadowCopyDeletion_CRITICAL'
    WHEN (
      UTF8(payload) ILIKE '%psexec.exe%' OR UTF8(payload) ILIKE '%psexec64.exe%'
      OR UTF8(payload) ILIKE '%paexec.exe%' OR UTF8(payload) ILIKE '%remcom.exe%'
      OR (UTF8(payload) ILIKE '%wmic%' AND UTF8(payload) ILIKE '%/node:%' AND UTF8(payload) ILIKE '%process call create%')
    ) THEN 'RemoteExecTool_HIGH'
    WHEN (
      (UTF8(payload) ILIKE '%\sc.exe%' OR UTF8(payload) ILIKE '% sc %')
      AND (UTF8(payload) ILIKE '%stop%' OR UTF8(payload) ILIKE '%delete%' OR UTF8(payload) ILIKE '%config%')
      AND (UTF8(payload) ILIKE '%WinDefend%' OR UTF8(payload) ILIKE '%SentinelAgent%'
           OR UTF8(payload) ILIKE '%CSFalconService%' OR UTF8(payload) ILIKE '%MpsSvc%'
           OR UTF8(payload) ILIKE '%WdFilter%' OR UTF8(payload) ILIKE '%WdNisSvc%')
    ) THEN 'DefenseImpairment_HIGH'
    WHEN (
      UTF8(payload) ILIKE '%taskkill%'
      AND (UTF8(payload) ILIKE '%msmpeng%' OR UTF8(payload) ILIKE '%mssense%'
           OR UTF8(payload) ILIKE '%csagent%' OR UTF8(payload) ILIKE '%sentinelagent%'
           OR UTF8(payload) ILIKE '%cbdaemon%' OR UTF8(payload) ILIKE '%mbam%')
    ) THEN 'DefenseImpairment_HIGH'
    ELSE 'Unknown'
  END AS StagingIndicator,
  CASE
    WHEN (UTF8(payload) ILIKE '%vssadmin%delete%' OR UTF8(payload) ILIKE '%bcdedit%recoveryenabled%'
          OR UTF8(payload) ILIKE '%wmic%shadowcopy%delete%') THEN 100
    WHEN (UTF8(payload) ILIKE '%sc.exe%stop%WinDefend%' OR UTF8(payload) ILIKE '%taskkill%msmpeng%'
          OR UTF8(payload) ILIKE '%taskkill%sentinelagent%') THEN 90
    WHEN (UTF8(payload) ILIKE '%psexec%' OR UTF8(payload) ILIKE '%paexec%' OR UTF8(payload) ILIKE '%remcom%') THEN 80
    ELSE 60
  END AS RiskScore,
  UTF8(payload) AS RawEvent
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 232, 261)
  AND (
    (UTF8(payload) ILIKE '%vssadmin%' AND (UTF8(payload) ILIKE '%delete%' OR UTF8(payload) ILIKE '%shadowstorage%'))
    OR (UTF8(payload) ILIKE '%wmic%' AND UTF8(payload) ILIKE '%shadowcopy%' AND UTF8(payload) ILIKE '%delete%')
    OR (UTF8(payload) ILIKE '%bcdedit%' AND (UTF8(payload) ILIKE '%recoveryenabled%' OR UTF8(payload) ILIKE '%bootstatuspolicy%'))
    OR (UTF8(payload) ILIKE '%powershell%' AND (UTF8(payload) ILIKE '%Delete-ShadowCopy%' OR UTF8(payload) ILIKE '%Win32_ShadowCopy%'))
    OR UTF8(payload) ILIKE '%psexec.exe%'
    OR UTF8(payload) ILIKE '%paexec.exe%'
    OR UTF8(payload) ILIKE '%remcom.exe%'
    OR (
      (UTF8(payload) ILIKE '%\sc.exe%' OR UTF8(payload) ILIKE '%sc.exe%')
      AND (UTF8(payload) ILIKE '%stop%' OR UTF8(payload) ILIKE '%delete%')
      AND (UTF8(payload) ILIKE '%WinDefend%' OR UTF8(payload) ILIKE '%SentinelAgent%' OR UTF8(payload) ILIKE '%CSFalconService%')
    )
    OR (
      UTF8(payload) ILIKE '%taskkill%'
      AND (UTF8(payload) ILIKE '%msmpeng%' OR UTF8(payload) ILIKE '%mssense%'
           OR UTF8(payload) ILIKE '%csagent%' OR UTF8(payload) ILIKE '%sentinelagent%')
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY RiskScore DESC, starttime DESC
LIMIT 500

Detects ransomware pre-deployment staging in QRadar AQL by querying Windows Security Event Log (EID 4688) and Microsoft Sysmon (EID 1) process creation events via payload string matching. Risk-scored CASE logic categorises matches into ShadowCopyDeletion_CRITICAL (RiskScore 100), DefenseImpairment_HIGH (90), and RemoteExecTool_HIGH (80) to enable SOC triage by severity tier. LOGSOURCETYPEID 12 = Windows Security, 232 = Sysmon, 261 = Windows System. Searches last 24 hours.

critical severity high confidence

Data Sources

IBM QRadar SIEM Windows Security Event Log (EID 4688 — Process Create) Microsoft Sysmon Event Log (EID 1 — Process Create) QRadar DSM for Microsoft Windows

Required Tables

events

False Positives

Backup software agents (Veeam, Commvault, Windows Server Backup) that invoke vssadmin to delete aged shadow copies during scheduled backup retention enforcement on backup servers
Authorized remote administration via PsExec or PAExec by helpdesk and sysadmin teams during maintenance windows, software rollouts, or post-incident remediation tasks across managed endpoints
Endpoint security platform migrations where operations engineers use sc.exe to stop and remove incumbent AV or EDR services before deploying a replacement — common during quarterly tooling refresh cycles

Sumo Logic CSE

sql

(_sourceCategory=*/Windows/Sysmon* OR _sourceCategory=*/WinEventLog/Security*)
| where (%"EventID" = "1" or %"EventID" = "4688" or EventID = 1 or EventID = 4688)
| parse field=_raw "Image: *\r" as Image nodrop
| parse field=_raw "CommandLine: *\r" as CommandLine nodrop
| parse field=_raw "Computer: *\r" as Computer nodrop
| parse field=_raw "User: *\r" as User nodrop
| parse field=_raw "NewProcessName: *\r" as NewProcessName nodrop
| parse field=_raw "CommandLine: *\r" as CommandLine2 nodrop
| if (isEmpty(Image), NewProcessName, Image) as ProcImage
| where (
    (ProcImage matches "*vssadmin.exe" and (CommandLine matches "*delete*" or CommandLine matches "*shadowstorage*" or CommandLine matches "*resize*"))
    or (ProcImage matches "*wmic.exe" and CommandLine matches "*shadowcopy*delete*")
    or (ProcImage matches "*bcdedit.exe" and (CommandLine matches "*recoveryenabled*" or CommandLine matches "*bootstatuspolicy*"))
    or (ProcImage matches "*powershell.exe" and (CommandLine matches "*Delete-ShadowCopy*" or CommandLine matches "*Win32_ShadowCopy*delete*"))
    or ProcImage matches "*psexec.exe"
    or ProcImage matches "*psexec64.exe"
    or ProcImage matches "*paexec.exe"
    or ProcImage matches "*remcom.exe"
    or (ProcImage matches "*sc.exe" and (CommandLine matches "*stop*" or CommandLine matches "*delete*" or CommandLine matches "*config*")
        and (CommandLine matches "*WinDefend*" or CommandLine matches "*SentinelAgent*"
             or CommandLine matches "*CSFalconService*" or CommandLine matches "*MpsSvc*"
             or CommandLine matches "*WdFilter*"))
    or (ProcImage matches "*taskkill.exe" and (CommandLine matches "*msmpeng*" or CommandLine matches "*mssense*"
        or CommandLine matches "*csagent*" or CommandLine matches "*sentinelagent*" or CommandLine matches "*cbdaemon*"))
    or (ProcImage matches "*reg.exe" and (CommandLine matches "*DisableAntiSpyware*" or CommandLine matches "*DisableRealtimeMonitoring*")
        and CommandLine matches "*Defender*")
  )
| eval StagingIndicator = if(
    (ProcImage matches "*vssadmin*" or ProcImage matches "*bcdedit*"
     or (ProcImage matches "*wmic*" and CommandLine matches "*shadowcopy*")
     or (ProcImage matches "*powershell*" and CommandLine matches "*ShadowCopy*")),
    "ShadowCopyDeletion_CRITICAL",
    if(ProcImage matches "*psexec*" or ProcImage matches "*paexec*" or ProcImage matches "*remcom*",
    "RemoteExecTool_HIGH",
    if(ProcImage matches "*sc.exe*" or ProcImage matches "*taskkill*" or ProcImage matches "*reg.exe*",
    "DefenseImpairment_HIGH",
    "StagingIndicator_MEDIUM")))
| eval RiskScore = if(StagingIndicator = "ShadowCopyDeletion_CRITICAL", 100,
    if(StagingIndicator = "DefenseImpairment_HIGH", 90,
    if(StagingIndicator = "RemoteExecTool_HIGH", 80, 60)))
| timeslice 30m
| stats
    count as EventCount,
    values(StagingIndicator) as Indicators,
    max(RiskScore) as MaxRisk,
    values(ProcImage) as Binaries,
    values(CommandLine) as Commands
    by _timeslice, Computer, User
| sort by MaxRisk desc

Detects ransomware pre-deployment staging in Sumo Logic by parsing Sysmon EID 1 and Windows Security EID 4688 process creation events. Covers shadow copy deletion (vssadmin/wmic/bcdedit/PowerShell), PsExec/PAExec/RemCom remote execution tool staging, and sc.exe/taskkill/reg.exe defense impairment against Windows Defender and third-party EDR agents. Groups into 30-minute timeslices with risk scoring (MaxRisk=100 for shadow deletion) to support analyst triage. Handles both Sysmon Image field and Security Log NewProcessName field via conditional normalization.

critical severity high confidence

Data Sources

Sumo Logic Cloud SIEM Windows Sysmon (Event ID 1 — Process Create) Windows Security Event Log (Event ID 4688 — Process Create)

Required Tables

_sourceCategory=*/Windows/Sysmon* _sourceCategory=*/WinEventLog/Security*

False Positives

Scheduled backup jobs that invoke vssadmin to delete aged shadow copies as part of storage quota management or backup retention policy on backup infrastructure (Veeam proxies, DPM servers)
Help desk or sysadmin use of PsExec or PAExec for legitimate remote task execution during routine support, software deployment, or authorized post-incident remediation across the domain
Planned security tooling migrations where operations teams use sc.exe stop/delete to remove incumbent AV or EDR services before installing a replacement endpoint agent — common during quarterly platform refresh

Google Chronicle / SecOps

yaral

rule ransomware_staging_indicators {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects ransomware pre-deployment staging: shadow copy deletion, remote execution tool staging, and defense impairment consistent with Akira, Black Basta, Play, and LockBit affiliate TTPs"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Impact, Defense Evasion, Lateral Movement"
    mitre_attack_technique = "T1490, T1562.001, T1021.002"
    reference = "NCSC UK 2025 Threat Report"
    created = "2026-04-24"
    threat_actors = "Akira, Black Basta, Play, LockBit, Medusa"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $hostname
    $proc.principal.user.userid = $user
    (
      // Shadow copy deletion - CRITICAL (T1490)
      (
        re.regex($proc.target.process.file.full_path, `(?i)vssadmin[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)(delete|resize|shadowstorage)`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)wmic[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)shadowcopy`) and
        re.regex($proc.target.process.command_line, `(?i)delete`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)bcdedit[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)(recoveryenabled|bootstatuspolicy|ignoreallfailures)`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)powershell[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)(Delete-ShadowCopy|Win32_ShadowCopy|vssadmin.*delete)`)
      ) or
      // Remote execution tool staging - HIGH (T1021.002)
      re.regex($proc.target.process.file.full_path, `(?i)(psexec|psexec64|paexec|remcom)[.]exe`) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)wmic[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)/node:`) and
        re.regex($proc.target.process.command_line, `(?i)process call create`)
      ) or
      // Defense impairment - HIGH (T1562.001)
      (
        re.regex($proc.target.process.file.full_path, `(?i)sc[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)(stop|delete|config)`) and
        re.regex($proc.target.process.command_line, `(?i)(WinDefend|Sense|MpsSvc|SentinelAgent|CSFalconService|WdFilter|WdNisSvc|SecurityHealthService)`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)taskkill[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)(msmpeng|mssense|csagent|sentinelagent|cbdaemon|mbam)`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)reg[.]exe`) and
        re.regex($proc.target.process.command_line, `(?i)(DisableAntiSpyware|DisableRealtimeMonitoring)`) and
        re.regex($proc.target.process.command_line, `(?i)(WinDefend|Windows.Defender|Defender)`)
      )
    )

  condition:
    $proc
}

Chronicle YARA-L 2.0 rule detecting ransomware pre-deployment staging across four behavioral signals using UDM PROCESS_LAUNCH events. Fires on any single match — shadow copy destruction via vssadmin/wmic/bcdedit/PowerShell (T1490), PsExec/PAExec/RemCom remote execution tool presence (T1021.002), and sc.exe/taskkill/reg.exe defense impairment targeting Windows Defender and third-party EDR agents (T1562.001). Single-event detection design ensures immediate alerting on the highest-fidelity indicators (shadow deletion) without requiring multi-event correlation. Correlate $proc.principal.hostname across multiple alerts within a 30-minute window to identify full staging sequences.

critical severity high confidence

Data Sources

Google Chronicle SIEM Chronicle Unified Data Model (UDM) — PROCESS_LAUNCH events Windows Event Logs ingested via Chronicle Forwarder Endpoint telemetry via Chronicle-integrated EDR (CrowdStrike, SentinelOne, Carbon Black)

Required Tables

UDM events (metadata.event_type = PROCESS_LAUNCH)

False Positives

Enterprise backup platforms (Veeam, Commvault, Veritas NetBackup) that issue vssadmin delete commands to manage VSS shadow storage quota during backup job finalization on backup proxy hosts
Authorized PsExec or PAExec usage by IT operations teams for remote software deployment, OS patch distribution, or incident response tasks across managed endpoints during approved maintenance windows
Security platform onboarding or replacement projects where operations engineers use sc.exe to stop and disable incumbent AV or EDR services before deploying the new endpoint agent

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| FileName = /(?i)(vssadmin|wmic|bcdedit|powershell|psexec|psexec64|paexec|remcom|sc|taskkill|reg)[.]exe/
| case {
    FileName = /(?i)vssadmin[.]exe/ AND CommandLine = /(?i)(delete|resize|shadowstorage)/
      | StagingIndicator := "ShadowCopyDeletion_CRITICAL"
      | RiskScore := 100 ;
    FileName = /(?i)wmic[.]exe/ AND CommandLine = /(?i)shadowcopy/ AND CommandLine = /(?i)delete/
      | StagingIndicator := "ShadowCopyDeletion_CRITICAL"
      | RiskScore := 100 ;
    FileName = /(?i)bcdedit[.]exe/ AND CommandLine = /(?i)(recoveryenabled|bootstatuspolicy|ignoreallfailures)/
      | StagingIndicator := "ShadowCopyDeletion_CRITICAL"
      | RiskScore := 100 ;
    FileName = /(?i)powershell[.]exe/ AND CommandLine = /(?i)(Delete-ShadowCopy|Win32_ShadowCopy.*delete|vssadmin.*delete)/
      | StagingIndicator := "ShadowCopyDeletion_CRITICAL"
      | RiskScore := 100 ;
    FileName = /(?i)(psexec|psexec64|paexec|remcom)[.]exe/
      | StagingIndicator := "RemoteExecTool_HIGH"
      | RiskScore := 80 ;
    FileName = /(?i)wmic[.]exe/ AND CommandLine = /(?i)\/node:/ AND CommandLine = /(?i)process call create/
      | StagingIndicator := "RemoteExecTool_HIGH"
      | RiskScore := 80 ;
    FileName = /(?i)sc[.]exe/ AND CommandLine = /(?i)(stop|delete|config)/ AND CommandLine = /(?i)(WinDefend|Sense|MpsSvc|SentinelAgent|CSFalconService|WdFilter|WdNisSvc|SecurityHealthService)/
      | StagingIndicator := "DefenseImpairment_HIGH"
      | RiskScore := 90 ;
    FileName = /(?i)taskkill[.]exe/ AND CommandLine = /(?i)(msmpeng|mssense|csagent|sentinelagent|cbdaemon|mbam)/
      | StagingIndicator := "DefenseImpairment_HIGH"
      | RiskScore := 90 ;
    FileName = /(?i)reg[.]exe/ AND CommandLine = /(?i)(DisableAntiSpyware|DisableRealtimeMonitoring)/ AND CommandLine = /(?i)(WinDefend|Defender)/
      | StagingIndicator := "DefenseImpairment_HIGH"
      | RiskScore := 90 ;
    * | drop()
  }
| groupBy(
    [ComputerName, UserName, StagingIndicator],
    function=[
      count(as=EventCount),
      collect(CommandLine, limit=20),
      collect(FileName, limit=10),
      max(RiskScore, as=MaxRisk)
    ]
  )
| sort(MaxRisk, order=desc)

CrowdStrike LogScale query detecting ransomware pre-deployment staging using Falcon ProcessRollup2 events. Matches vssadmin/wmic/bcdedit/PowerShell shadow copy deletion (RiskScore 100), PsExec/PAExec/RemCom remote execution tool staging (RiskScore 80), and sc.exe/taskkill/reg.exe defense impairment targeting Windows Defender and third-party EDR processes (RiskScore 90). The drop() call at the end of the case statement discards unmatched process events, keeping output clean and reducing noise. Groups by host, user, and indicator type with max risk score and collected command lines for analyst triage. Consistent with Akira, Black Basta, Play, and LockBit affiliate staging sequences.

critical severity high confidence

Data Sources

CrowdStrike Falcon Platform CrowdStrike Falcon LogScale (Humio) Falcon ProcessRollup2 event stream (process execution telemetry)

Required Tables

ProcessRollup2

False Positives

Backup administrators invoking vssadmin to delete aged shadow copies as part of scheduled storage quota management or backup retention policy enforcement on backup proxy or media server hosts
IT support staff using PsExec or PAExec for legitimate remote command execution during helpdesk troubleshooting, software deployment, or authorized remediation tasks on managed endpoints
Security platform onboarding workflows that use sc.exe to stop and remove incumbent AV or EDR services (WinDefend, Sense) before installing or upgrading the Falcon sensor or migrating to a new endpoint security platform

Sigma rule & cross-platform mapping

The detection logic for Ransomware Pre-Deployment Staging Indicators (THREAT-Ransomware-StagingIndicators) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-Ransomware-StagingIndicators Sigma rules on detection.fyi

Platform-specific guides for THREAT-Ransomware-StagingIndicators

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-24 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)
Expected signal: Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
Test 2Windows Defender Disable via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.

Response Playbook

Triage

Shadow copy deletion is a near-certain ransomware precursor — if vssadmin delete or wmic shadowcopy delete is detected, trigger incident response immediately without waiting for additional confirmation.
Identify the user and process context: is this a service account, a domain admin, or a standard user? Ransomware staging almost always involves elevated privileges. Check how those privileges were obtained.
Map the affected hosts: are multiple hosts showing staging indicators simultaneously? Multi-host staging indicates the attacker has already achieved domain compromise and is preparing for a domain-wide deployment.
Check for PsExec or PAExec: the presence of these tools in unusual locations (C:\Users\, C:\ProgramData\, C:\Windows\Temp\) is a ransomware staging indicator even without shadow copy deletion.
Review network traffic from affected hosts for bulk file access (the attacker may also be exfiltrating data before encryption — double extortion).

Containment

Isolate affected endpoints via EDR host isolation immediately upon shadow copy deletion detection. Do not wait — encryption may begin within minutes.
Block lateral movement: disable RDP, SMB, and WinRM to non-management hosts at the firewall if domain-wide staging is detected.
Preserve shadow copies on unaffected systems immediately: run vssadmin create shadow /for=C: on all critical servers that haven't been affected.
Force-disable any identified compromised accounts (domain admin accounts used for staging).
Take offline backups: if you have offline/immutable backups, verify their integrity immediately and isolate backup infrastructure from the network.

Evidence Collection

Process creation logs (Sysmon Event ID 1 or Security 4688) for all staging binaries
Network file access logs: which shares were accessed, how many files, what size
Authentication logs: which account(s) were used for PsExec/WMI remote execution
EDR timeline for affected hosts: full process tree, file writes, network connections in 48h window before staging
Active Directory logs: any privilege escalation or new account creation preceding staging

Escalation Criteria

! Shadow copy deletion detected on any host — immediate incident declaration
! PsExec or PAExec executed from unusual locations by unusual accounts
! AV/EDR impairment attempts affecting multiple hosts
! Staging indicators across 5+ hosts simultaneously — indicates domain-wide deployment preparation
! Data staging directories created with large file counts (exfiltration before encryption)

Investigation Guide

Forensic Artifacts

> Sysmon Event ID 1 process creation for vssadmin, wmic, psexec, sc, taskkill
> Windows Event ID 7040 (service disabled) for AV/EDR service impairment
> File system: presence of staging binaries (psexec.exe, paexec.exe) in temp directories
> Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender for Group Policy-level AV disablement
> Network shares: SMB access logs showing bulk file reads from domain controller or file server (exfiltration)

Tuning Guidance

Shadow copy deletion is almost never a legitimate user action — the only expected sources are backup software service accounts (Veeam, Acronis, Windows Backup service). Create an exclusion list for those specific service account names and parent process names (e.g., VeeamBackupSvc, BackupExec). For PsExec, create allowlist exceptions for known IT admin accounts. The AV/EDR impairment detection has more potential for false positives from legitimate security tool upgrades — add exclusions for vendor-specific processes (CrowdStrike, Defender update processes). The key is treating shadow copy deletion as an immediate incident trigger, not a standard alert.

Hunting Queries

Hunt for shadow copy and backup deletion commands across the environment — any occurrence is high-priority given lack of legitimate use cases for these specific command patterns outside of authorised backup tooling.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
    and ProcessCommandLine has_any ("delete", "shadowcopy", "shadow", "recoveryenabled")
| summarize Count=count(), Hosts=make_set(DeviceName)
  by FileName, ProcessCommandLine
| sort by Count desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\vssadmin.exe" OR Image="*\\wmic.exe" OR Image="*\\bcdedit.exe")
  (CommandLine="*delete*" OR CommandLine="*shadow*" OR CommandLine="*recoveryenabled*")
| stats count AS Hits, dc(host) AS HostCount, values(host) AS Hosts
  BY Image, CommandLine
| sort - Hits

Atomic Red Team Tests

Test 1 Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)

windows

Deletes volume shadow copies using vssadmin — the most common ransomware staging indicator. This should be run in a sandbox environment only.

Command

powershell

vssadmin delete shadows /all /quiet

Expected Telemetry

Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.

Expected Detection

Alert fires on ShadowCopyDeletion indicator with RiskScore=100. Immediate escalation required.

Test 2 Windows Defender Disable via PowerShell

windows

Disables Windows Defender real-time monitoring using PowerShell registry modification — a documented Akira and Black Basta staging step.

Command

powershell

powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

Cleanup

powershell

powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $false"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.

Expected Detection

Alert fires on DefenseImpairment indicator. Cross-correlate with other staging indicators on same host.

Related Detections

What is THREAT-Ransomware-StagingIndicators Ransomware Pre-Deployment Staging Indicators?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Ransomware-StagingIndicators

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Parent Technique

Related Techniques

Same Tactic: Impact

Popular Detections

Get new detections in your inbox