Detect Ransomware Pre-Deployment Staging Indicators in Splunk
The hours before ransomware deployment follow a repeatable pattern regardless of group: network share enumeration, credential dumping, detection tool impairment, and staging of the ransomware binary in accessible locations. NCSC UK 2025 threat report identified Akira, Black Basta, and Play as the most active ransomware groups targeting UK SMBs. The staging sequence typically occurs within 1-48 hours before encryption begins, offering a detection opportunity. Key indicators: (1) net use or net share enumeration across the network; (2) vssadmin.exe or wmic delete shadowstorage (shadow copy deletion — the final indicator before encryption); (3) remote execution tool setup (PsExec, PAExec, WMI, WinRM) preparing for domain-wide payload deployment; (4) large file transfers or staging directories created; (5) AV/EDR impairment attempts. This detection targets the staging window before encryption — detection here prevents the actual ransomware event.
MITRE ATT&CK
- Tactic
- Impact Discovery Lateral Movement
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(
(Image="*\\vssadmin.exe" AND (CommandLine="*delete*" OR CommandLine="*resize*" OR CommandLine="*shadowstorage*"))
OR (Image="*\\wmic.exe" AND CommandLine="*shadowcopy*" AND CommandLine="*delete*")
OR (Image="*\\bcdedit.exe" AND (CommandLine="*recoveryenabled*" OR CommandLine="*bootstatuspolicy*"))
)
OR
(
Image IN ("*\\psexec.exe", "*\\psexec64.exe", "*\\paexec.exe", "*\\remcom.exe")
)
OR
(
Image="*\\sc.exe" AND
(CommandLine="*stop*" OR CommandLine="*delete*" OR CommandLine="*config*") AND
(CommandLine="*WinDefend*" OR CommandLine="*Sense*" OR CommandLine="*MpsSvc*" OR
CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*" OR CommandLine="*mbam*")
)
OR
(
Image="*\\taskkill.exe" AND
(CommandLine="*msmpeng*" OR CommandLine="*mssense*" OR CommandLine="*csagent*" OR
CommandLine="*sentinelagent*" OR CommandLine="*cbdaemon*")
)
)
| eval StagingIndicator=case(
match(Image, "(?i)vssadmin|bcdedit") OR (match(Image, "(?i)wmic") AND match(CommandLine, "(?i)shadowcopy.*delete")),
"ShadowCopyDeletion_CRITICAL",
match(Image, "(?i)(psexec|paexec|remcom)"),
"RemoteExecTool_HIGH",
match(Image, "(?i)sc\.exe") OR match(Image, "(?i)taskkill"),
"DefenseImpairment_HIGH",
true(), "Other_MEDIUM"
)
| eval RiskScore=case(
StagingIndicator="ShadowCopyDeletion_CRITICAL", 100,
StagingIndicator="DefenseImpairment_HIGH", 90,
StagingIndicator="RemoteExecTool_HIGH", 80,
true(), 60
)
| stats
count AS EventCount,
values(StagingIndicator) AS Indicators,
values(CommandLine) AS Commands,
max(RiskScore) AS MaxRisk,
values(Image) AS Binaries
BY host, User, _time span=30m
| eval ThreatActors="Akira, Black Basta, LockBit, Play, Medusa"
| sort - MaxRiskSPL ransomware staging detection via Sysmon process creation. Covers all four staging indicator categories with a RiskScore-based prioritisation. Shadow copy deletion (RiskScore=100) indicates encryption is imminent; AV impairment (90) indicates active defense bypass in progress. Correlating multiple indicators from the same host in a 30-minute window is a high-confidence pre-ransomware indicator.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Veeam or other backup tools managing VSS shadow copies
- IT administrators using PsExec for remote administration tasks
- Security tools stopping conflicting endpoint protection during upgrade
Other platforms for THREAT-Ransomware-StagingIndicators
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)
Expected signal: Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
- Test 2Windows Defender Disable via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
References (6)
- https://www.ncsc.gov.uk/news/uk-organisations-warned-about-ransomware-escalation
- https://www.cisa.gov/stopransomware/akira-ransomware
- https://www.cisa.gov/stopransomware/black-basta
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/techniques/T1562/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock Pro Content
Get the full detection package for THREAT-Ransomware-StagingIndicators including response playbook, investigation guide, and atomic red team tests.