Detect Ransomware Pre-Deployment Staging Indicators in Elastic Security
The hours before ransomware deployment follow a repeatable pattern regardless of group: network share enumeration, credential dumping, detection tool impairment, and staging of the ransomware binary in accessible locations. NCSC UK 2025 threat report identified Akira, Black Basta, and Play as the most active ransomware groups targeting UK SMBs. The staging sequence typically occurs within 1-48 hours before encryption begins, offering a detection opportunity. Key indicators: (1) net use or net share enumeration across the network; (2) vssadmin.exe or wmic delete shadowstorage (shadow copy deletion — the final indicator before encryption); (3) remote execution tool setup (PsExec, PAExec, WMI, WinRM) preparing for domain-wide payload deployment; (4) large file transfers or staging directories created; (5) AV/EDR impairment attempts. This detection targets the staging window before encryption — detection here prevents the actual ransomware event.
MITRE ATT&CK
- Tactic
- Impact Discovery Lateral Movement
Elastic Detection Query
any where event.category == "process" and event.type == "start" and (
/* Shadow copy deletion - CRITICAL (T1490) */
(process.name : "vssadmin.exe" and process.command_line : ("*delete*", "*shadowstorage*", "*resize*")) or
(process.name : "wmic.exe" and process.command_line : "*shadowcopy*delete*") or
(process.name : "bcdedit.exe" and process.command_line : ("*recoveryenabled*", "*bootstatuspolicy*", "*ignoreallfailures*")) or
(process.name : "powershell.exe" and process.command_line : ("*Delete-ShadowCopy*", "*Win32_ShadowCopy*delete*", "*vssadmin*delete*")) or
/* Remote execution tool staging - HIGH (T1021.002) */
process.name : ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe") or
(process.name : "wmic.exe" and process.command_line : "*/node:*" and process.command_line : "*process call create*") or
/* Defense impairment - HIGH (T1562.001) */
(
process.name : "sc.exe" and
process.command_line : ("*stop*", "*delete*", "*config*") and
process.command_line : ("*WinDefend*", "*Sense*", "*MpsSvc*", "*SentinelAgent*", "*CSFalconService*", "*WdFilter*", "*WdNisSvc*", "*SecurityHealthService*")
) or
(
process.name : "taskkill.exe" and
process.command_line : ("*msmpeng*", "*mssense*", "*csagent*", "*sentinelagent*", "*cbdaemon*", "*mbam*")
) or
(
process.name : "reg.exe" and
process.command_line : ("*add*", "*delete*") and
process.command_line : ("*DisableAntiSpyware*", "*DisableRealtimeMonitoring*", "*Windows Defender*", "*WinDefend*")
)
)Detects ransomware pre-deployment staging indicators across four behavioral axes using Elastic ECS process events: shadow copy deletion (T1490 — highest fidelity pre-encryption indicator, RiskScore 100), remote execution tool staging via PsExec/PAExec/RemCom (T1021.002, RiskScore 80), and defense impairment targeting Windows Defender and third-party EDR agents via sc.exe, taskkill, or reg.exe (T1562.001, RiskScore 90). Consistent with Akira, Black Basta, Play, and LockBit affiliate staging sequences observed by NCSC UK in 2025.
Data Sources
Required Tables
False Positives & Tuning
- Backup administrators running legitimate VSS snapshot management via vssadmin delete on dedicated backup servers as part of scheduled retention policy enforcement (Veeam, Commvault, Veritas agents)
- IT operations teams using PsExec or PAExec for authorized remote software deployment, OS patch distribution, or incident response tasks across domain-joined endpoints during maintenance windows
- Security platform migration projects that stop or disable incumbent AV/EDR services (WinDefend, Sense, legacy AV) using sc.exe before installing a replacement endpoint security stack
Other platforms for THREAT-Ransomware-StagingIndicators
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)
Expected signal: Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
- Test 2 Windows Defender Disable via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
Response Playbook
Triage
- Shadow copy deletion is a near-certain ransomware precursor — if vssadmin delete or wmic shadowcopy delete is detected, trigger incident response immediately without waiting for additional confirmation.
- Identify the user and process context: is this a service account, a domain admin, or a standard user? Ransomware staging almost always involves elevated privileges. Check how those privileges were obtained.
- Map the affected hosts: are multiple hosts showing staging indicators simultaneously? Multi-host staging indicates the attacker has already achieved domain compromise and is preparing for a domain-wide deployment.
- Check for PsExec or PAExec: the presence of these tools in unusual locations (C:\Users\, C:\ProgramData\, C:\Windows\Temp\) is a ransomware staging indicator even without shadow copy deletion.
- Review network traffic from affected hosts for bulk file access (the attacker may also be exfiltrating data before encryption — double extortion).
Containment
- Isolate affected endpoints via EDR host isolation immediately upon shadow copy deletion detection. Do not wait — encryption may begin within minutes.
- Block lateral movement: disable RDP, SMB, and WinRM to non-management hosts at the firewall if domain-wide staging is detected.
- Preserve shadow copies on unaffected systems immediately: run vssadmin create shadow /for=C: on all critical servers that haven't been affected.
- Force-disable any identified compromised accounts (domain admin accounts used for staging).
- Take offline backups: if you have offline/immutable backups, verify their integrity immediately and isolate backup infrastructure from the network.
Evidence Collection
- Process creation logs (Sysmon Event ID 1 or Security 4688) for all staging binaries
- Network file access logs: which shares were accessed, how many files, what size
- Authentication logs: which account(s) were used for PsExec/WMI remote execution
- EDR timeline for affected hosts: full process tree, file writes, network connections in 48h window before staging
- Active Directory logs: any privilege escalation or new account creation preceding staging
Escalation Criteria
- !Shadow copy deletion detected on any host — immediate incident declaration
- !PsExec or PAExec executed from unusual locations by unusual accounts
- !AV/EDR impairment attempts affecting multiple hosts
- !Staging indicators across 5+ hosts simultaneously — indicates domain-wide deployment preparation
- !Data staging directories created with large file counts (exfiltration before encryption)
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1 process creation for vssadmin, wmic, psexec, sc, taskkill - >
Windows Event ID 7040 (service disabled) for AV/EDR service impairment - >
File system: presence of staging binaries (psexec.exe, paexec.exe) in temp directories - >
Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender for Group Policy-level AV disablement - >
Network shares: SMB access logs showing bulk file reads from domain controller or file server (exfiltration)
Tuning Guidance
Shadow copy deletion is almost never a legitimate user action — the only expected sources are backup software service accounts (Veeam, Acronis, Windows Backup service). Create an exclusion list for those specific service account names and parent process names (e.g., VeeamBackupSvc, BackupExec). For PsExec, create allowlist exceptions for known IT admin accounts. The AV/EDR impairment detection has more potential for false positives from legitimate security tool upgrades — add exclusions for vendor-specific processes (CrowdStrike, Defender update processes). The key is treating shadow copy deletion as an immediate incident trigger, not a standard alert.
Hunting Queries
Hunt for shadow copy and backup deletion commands across the environment — any occurrence is high-priority given lack of legitimate use cases for these specific command patterns outside of authorised backup tooling.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
and ProcessCommandLine has_any ("delete", "shadowcopy", "shadow", "recoveryenabled")
| summarize Count=count(), Hosts=make_set(DeviceName)
by FileName, ProcessCommandLine
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\vssadmin.exe" OR Image="*\\wmic.exe" OR Image="*\\bcdedit.exe")
(CommandLine="*delete*" OR CommandLine="*shadow*" OR CommandLine="*recoveryenabled*")
| stats count AS Hits, dc(host) AS HostCount, values(host) AS Hosts
BY Image, CommandLine
| sort - HitsAtomic Red Team Tests
Deletes volume shadow copies using vssadmin — the most common ransomware staging indicator. This should be run in a sandbox environment only.
Command
vssadmin delete shadows /all /quietExpected Telemetry
Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
Expected Detection
Alert fires on ShadowCopyDeletion indicator with RiskScore=100. Immediate escalation required.
Disables Windows Defender real-time monitoring using PowerShell registry modification — a documented Akira and Black Basta staging step.
Command
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Cleanup
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $false"Expected Telemetry
Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
Expected Detection
Alert fires on DefenseImpairment indicator. Cross-correlate with other staging indicators on same host.