Detect Ransomware Pre-Deployment Staging Indicators in Elastic Security
The hours before ransomware deployment follow a repeatable pattern regardless of group: network share enumeration, credential dumping, detection tool impairment, and staging of the ransomware binary in accessible locations. NCSC UK 2025 threat report identified Akira, Black Basta, and Play as the most active ransomware groups targeting UK SMBs. The staging sequence typically occurs within 1-48 hours before encryption begins, offering a detection opportunity. Key indicators: (1) net use or net share enumeration across the network; (2) vssadmin.exe or wmic delete shadowstorage (shadow copy deletion — the final indicator before encryption); (3) remote execution tool setup (PsExec, PAExec, WMI, WinRM) preparing for domain-wide payload deployment; (4) large file transfers or staging directories created; (5) AV/EDR impairment attempts. This detection targets the staging window before encryption — detection here prevents the actual ransomware event.
MITRE ATT&CK
- Tactic
- Impact Discovery Lateral Movement
Elastic Detection Query
any where event.category == "process" and event.type == "start" and (
/* Shadow copy deletion - CRITICAL (T1490) */
(process.name : "vssadmin.exe" and process.command_line : ("*delete*", "*shadowstorage*", "*resize*")) or
(process.name : "wmic.exe" and process.command_line : "*shadowcopy*delete*") or
(process.name : "bcdedit.exe" and process.command_line : ("*recoveryenabled*", "*bootstatuspolicy*", "*ignoreallfailures*")) or
(process.name : "powershell.exe" and process.command_line : ("*Delete-ShadowCopy*", "*Win32_ShadowCopy*delete*", "*vssadmin*delete*")) or
/* Remote execution tool staging - HIGH (T1021.002) */
process.name : ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe") or
(process.name : "wmic.exe" and process.command_line : "*/node:*" and process.command_line : "*process call create*") or
/* Defense impairment - HIGH (T1562.001) */
(
process.name : "sc.exe" and
process.command_line : ("*stop*", "*delete*", "*config*") and
process.command_line : ("*WinDefend*", "*Sense*", "*MpsSvc*", "*SentinelAgent*", "*CSFalconService*", "*WdFilter*", "*WdNisSvc*", "*SecurityHealthService*")
) or
(
process.name : "taskkill.exe" and
process.command_line : ("*msmpeng*", "*mssense*", "*csagent*", "*sentinelagent*", "*cbdaemon*", "*mbam*")
) or
(
process.name : "reg.exe" and
process.command_line : ("*add*", "*delete*") and
process.command_line : ("*DisableAntiSpyware*", "*DisableRealtimeMonitoring*", "*Windows Defender*", "*WinDefend*")
)
)Detects ransomware pre-deployment staging indicators across four behavioral axes using Elastic ECS process events: shadow copy deletion (T1490 — highest fidelity pre-encryption indicator, RiskScore 100), remote execution tool staging via PsExec/PAExec/RemCom (T1021.002, RiskScore 80), and defense impairment targeting Windows Defender and third-party EDR agents via sc.exe, taskkill, or reg.exe (T1562.001, RiskScore 90). Consistent with Akira, Black Basta, Play, and LockBit affiliate staging sequences observed by NCSC UK in 2025.
Data Sources
Required Tables
False Positives & Tuning
- Backup administrators running legitimate VSS snapshot management via vssadmin delete on dedicated backup servers as part of scheduled retention policy enforcement (Veeam, Commvault, Veritas agents)
- IT operations teams using PsExec or PAExec for authorized remote software deployment, OS patch distribution, or incident response tasks across domain-joined endpoints during maintenance windows
- Security platform migration projects that stop or disable incumbent AV/EDR services (WinDefend, Sense, legacy AV) using sc.exe before installing a replacement endpoint security stack
Other platforms for THREAT-Ransomware-StagingIndicators
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)
Expected signal: Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
- Test 2Windows Defender Disable via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
References (6)
- https://www.ncsc.gov.uk/news/uk-organisations-warned-about-ransomware-escalation
- https://www.cisa.gov/stopransomware/akira-ransomware
- https://www.cisa.gov/stopransomware/black-basta
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/techniques/T1562/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock Pro Content
Get the full detection package for THREAT-Ransomware-StagingIndicators including response playbook, investigation guide, and atomic red team tests.