Detect Ransomware Pre-Deployment Staging Indicators in IBM QRadar
The hours before ransomware deployment follow a repeatable pattern regardless of group: network share enumeration, credential dumping, detection tool impairment, and staging of the ransomware binary in accessible locations. NCSC UK 2025 threat report identified Akira, Black Basta, and Play as the most active ransomware groups targeting UK SMBs. The staging sequence typically occurs within 1-48 hours before encryption begins, offering a detection opportunity. Key indicators: (1) net use or net share enumeration across the network; (2) vssadmin.exe or wmic delete shadowstorage (shadow copy deletion — the final indicator before encryption); (3) remote execution tool setup (PsExec, PAExec, WMI, WinRM) preparing for domain-wide payload deployment; (4) large file transfers or staging directories created; (5) AV/EDR impairment attempts. This detection targets the staging window before encryption — detection here prevents the actual ransomware event.
MITRE ATT&CK
- Tactic
- Impact Discovery Lateral Movement
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
devicename AS ComputerName,
username AS Username,
QIDNAME(qid) AS EventName,
LOGSOURCENAME(logsourceid) AS LogSource,
CASE
WHEN (
(UTF8(payload) ILIKE '%vssadmin%' AND (UTF8(payload) ILIKE '%delete%' OR UTF8(payload) ILIKE '%shadowstorage%'))
OR (UTF8(payload) ILIKE '%wmic%' AND UTF8(payload) ILIKE '%shadowcopy%' AND UTF8(payload) ILIKE '%delete%')
OR (UTF8(payload) ILIKE '%bcdedit%' AND (UTF8(payload) ILIKE '%recoveryenabled%' OR UTF8(payload) ILIKE '%bootstatuspolicy%'))
OR (UTF8(payload) ILIKE '%powershell%' AND (UTF8(payload) ILIKE '%Delete-ShadowCopy%' OR UTF8(payload) ILIKE '%Win32_ShadowCopy%delete%'))
) THEN 'ShadowCopyDeletion_CRITICAL'
WHEN (
UTF8(payload) ILIKE '%psexec.exe%' OR UTF8(payload) ILIKE '%psexec64.exe%'
OR UTF8(payload) ILIKE '%paexec.exe%' OR UTF8(payload) ILIKE '%remcom.exe%'
OR (UTF8(payload) ILIKE '%wmic%' AND UTF8(payload) ILIKE '%/node:%' AND UTF8(payload) ILIKE '%process call create%')
) THEN 'RemoteExecTool_HIGH'
WHEN (
(UTF8(payload) ILIKE '%\sc.exe%' OR UTF8(payload) ILIKE '% sc %')
AND (UTF8(payload) ILIKE '%stop%' OR UTF8(payload) ILIKE '%delete%' OR UTF8(payload) ILIKE '%config%')
AND (UTF8(payload) ILIKE '%WinDefend%' OR UTF8(payload) ILIKE '%SentinelAgent%'
OR UTF8(payload) ILIKE '%CSFalconService%' OR UTF8(payload) ILIKE '%MpsSvc%'
OR UTF8(payload) ILIKE '%WdFilter%' OR UTF8(payload) ILIKE '%WdNisSvc%')
) THEN 'DefenseImpairment_HIGH'
WHEN (
UTF8(payload) ILIKE '%taskkill%'
AND (UTF8(payload) ILIKE '%msmpeng%' OR UTF8(payload) ILIKE '%mssense%'
OR UTF8(payload) ILIKE '%csagent%' OR UTF8(payload) ILIKE '%sentinelagent%'
OR UTF8(payload) ILIKE '%cbdaemon%' OR UTF8(payload) ILIKE '%mbam%')
) THEN 'DefenseImpairment_HIGH'
ELSE 'Unknown'
END AS StagingIndicator,
CASE
WHEN (UTF8(payload) ILIKE '%vssadmin%delete%' OR UTF8(payload) ILIKE '%bcdedit%recoveryenabled%'
OR UTF8(payload) ILIKE '%wmic%shadowcopy%delete%') THEN 100
WHEN (UTF8(payload) ILIKE '%sc.exe%stop%WinDefend%' OR UTF8(payload) ILIKE '%taskkill%msmpeng%'
OR UTF8(payload) ILIKE '%taskkill%sentinelagent%') THEN 90
WHEN (UTF8(payload) ILIKE '%psexec%' OR UTF8(payload) ILIKE '%paexec%' OR UTF8(payload) ILIKE '%remcom%') THEN 80
ELSE 60
END AS RiskScore,
UTF8(payload) AS RawEvent
FROM events
WHERE
LOGSOURCETYPEID IN (12, 232, 261)
AND (
(UTF8(payload) ILIKE '%vssadmin%' AND (UTF8(payload) ILIKE '%delete%' OR UTF8(payload) ILIKE '%shadowstorage%'))
OR (UTF8(payload) ILIKE '%wmic%' AND UTF8(payload) ILIKE '%shadowcopy%' AND UTF8(payload) ILIKE '%delete%')
OR (UTF8(payload) ILIKE '%bcdedit%' AND (UTF8(payload) ILIKE '%recoveryenabled%' OR UTF8(payload) ILIKE '%bootstatuspolicy%'))
OR (UTF8(payload) ILIKE '%powershell%' AND (UTF8(payload) ILIKE '%Delete-ShadowCopy%' OR UTF8(payload) ILIKE '%Win32_ShadowCopy%'))
OR UTF8(payload) ILIKE '%psexec.exe%'
OR UTF8(payload) ILIKE '%paexec.exe%'
OR UTF8(payload) ILIKE '%remcom.exe%'
OR (
(UTF8(payload) ILIKE '%\sc.exe%' OR UTF8(payload) ILIKE '%sc.exe%')
AND (UTF8(payload) ILIKE '%stop%' OR UTF8(payload) ILIKE '%delete%')
AND (UTF8(payload) ILIKE '%WinDefend%' OR UTF8(payload) ILIKE '%SentinelAgent%' OR UTF8(payload) ILIKE '%CSFalconService%')
)
OR (
UTF8(payload) ILIKE '%taskkill%'
AND (UTF8(payload) ILIKE '%msmpeng%' OR UTF8(payload) ILIKE '%mssense%'
OR UTF8(payload) ILIKE '%csagent%' OR UTF8(payload) ILIKE '%sentinelagent%')
)
)
AND starttime > NOW() - 86400000
ORDER BY RiskScore DESC, starttime DESC
LIMIT 500Detects ransomware pre-deployment staging in QRadar AQL by querying Windows Security Event Log (EID 4688) and Microsoft Sysmon (EID 1) process creation events via payload string matching. Risk-scored CASE logic categorises matches into ShadowCopyDeletion_CRITICAL (RiskScore 100), DefenseImpairment_HIGH (90), and RemoteExecTool_HIGH (80) to enable SOC triage by severity tier. LOGSOURCETYPEID 12 = Windows Security, 232 = Sysmon, 261 = Windows System. Searches last 24 hours.
Data Sources
Required Tables
False Positives & Tuning
- Backup software agents (Veeam, Commvault, Windows Server Backup) that invoke vssadmin to delete aged shadow copies during scheduled backup retention enforcement on backup servers
- Authorized remote administration via PsExec or PAExec by helpdesk and sysadmin teams during maintenance windows, software rollouts, or post-incident remediation tasks across managed endpoints
- Endpoint security platform migrations where operations engineers use sc.exe to stop and remove incumbent AV or EDR services before deploying a replacement — common during quarterly tooling refresh cycles
Other platforms for THREAT-Ransomware-StagingIndicators
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)
Expected signal: Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
- Test 2 Windows Defender Disable via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
Response Playbook
Triage
- Shadow copy deletion is a near-certain ransomware precursor — if vssadmin delete or wmic shadowcopy delete is detected, trigger incident response immediately without waiting for additional confirmation.
- Identify the user and process context: is this a service account, a domain admin, or a standard user? Ransomware staging almost always involves elevated privileges. Check how those privileges were obtained.
- Map the affected hosts: are multiple hosts showing staging indicators simultaneously? Multi-host staging indicates the attacker has already achieved domain compromise and is preparing for a domain-wide deployment.
- Check for PsExec or PAExec: the presence of these tools in unusual locations (C:\Users\, C:\ProgramData\, C:\Windows\Temp\) is a ransomware staging indicator even without shadow copy deletion.
- Review network traffic from affected hosts for bulk file access (the attacker may also be exfiltrating data before encryption — double extortion).
Containment
- Isolate affected endpoints via EDR host isolation immediately upon shadow copy deletion detection. Do not wait — encryption may begin within minutes.
- Block lateral movement: disable RDP, SMB, and WinRM to non-management hosts at the firewall if domain-wide staging is detected.
- Preserve shadow copies on unaffected systems immediately: run vssadmin create shadow /for=C: on all critical servers that haven't been affected.
- Force-disable any identified compromised accounts (domain admin accounts used for staging).
- Take offline backups: if you have offline/immutable backups, verify their integrity immediately and isolate backup infrastructure from the network.
Evidence Collection
- Process creation logs (Sysmon Event ID 1 or Security 4688) for all staging binaries
- Network file access logs: which shares were accessed, how many files, what size
- Authentication logs: which account(s) were used for PsExec/WMI remote execution
- EDR timeline for affected hosts: full process tree, file writes, network connections in 48h window before staging
- Active Directory logs: any privilege escalation or new account creation preceding staging
Escalation Criteria
- !Shadow copy deletion detected on any host — immediate incident declaration
- !PsExec or PAExec executed from unusual locations by unusual accounts
- !AV/EDR impairment attempts affecting multiple hosts
- !Staging indicators across 5+ hosts simultaneously — indicates domain-wide deployment preparation
- !Data staging directories created with large file counts (exfiltration before encryption)
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1 process creation for vssadmin, wmic, psexec, sc, taskkill - >
Windows Event ID 7040 (service disabled) for AV/EDR service impairment - >
File system: presence of staging binaries (psexec.exe, paexec.exe) in temp directories - >
Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender for Group Policy-level AV disablement - >
Network shares: SMB access logs showing bulk file reads from domain controller or file server (exfiltration)
Tuning Guidance
Shadow copy deletion is almost never a legitimate user action — the only expected sources are backup software service accounts (Veeam, Acronis, Windows Backup service). Create an exclusion list for those specific service account names and parent process names (e.g., VeeamBackupSvc, BackupExec). For PsExec, create allowlist exceptions for known IT admin accounts. The AV/EDR impairment detection has more potential for false positives from legitimate security tool upgrades — add exclusions for vendor-specific processes (CrowdStrike, Defender update processes). The key is treating shadow copy deletion as an immediate incident trigger, not a standard alert.
Hunting Queries
Hunt for shadow copy and backup deletion commands across the environment — any occurrence is high-priority given lack of legitimate use cases for these specific command patterns outside of authorised backup tooling.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
and ProcessCommandLine has_any ("delete", "shadowcopy", "shadow", "recoveryenabled")
| summarize Count=count(), Hosts=make_set(DeviceName)
by FileName, ProcessCommandLine
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\vssadmin.exe" OR Image="*\\wmic.exe" OR Image="*\\bcdedit.exe")
(CommandLine="*delete*" OR CommandLine="*shadow*" OR CommandLine="*recoveryenabled*")
| stats count AS Hits, dc(host) AS HostCount, values(host) AS Hosts
BY Image, CommandLine
| sort - HitsAtomic Red Team Tests
Deletes volume shadow copies using vssadmin — the most common ransomware staging indicator. This should be run in a sandbox environment only.
Command
vssadmin delete shadows /all /quietExpected Telemetry
Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
Expected Detection
Alert fires on ShadowCopyDeletion indicator with RiskScore=100. Immediate escalation required.
Disables Windows Defender real-time monitoring using PowerShell registry modification — a documented Akira and Black Basta staging step.
Command
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Cleanup
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $false"Expected Telemetry
Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
Expected Detection
Alert fires on DefenseImpairment indicator. Cross-correlate with other staging indicators on same host.