Detect Ransomware Pre-Deployment Staging Indicators in Sumo Logic CSE
The hours before ransomware deployment follow a repeatable pattern regardless of group: network share enumeration, credential dumping, detection tool impairment, and staging of the ransomware binary in accessible locations. NCSC UK 2025 threat report identified Akira, Black Basta, and Play as the most active ransomware groups targeting UK SMBs. The staging sequence typically occurs within 1-48 hours before encryption begins, offering a detection opportunity. Key indicators: (1) net use or net share enumeration across the network; (2) vssadmin.exe or wmic delete shadowstorage (shadow copy deletion — the final indicator before encryption); (3) remote execution tool setup (PsExec, PAExec, WMI, WinRM) preparing for domain-wide payload deployment; (4) large file transfers or staging directories created; (5) AV/EDR impairment attempts. This detection targets the staging window before encryption — detection here prevents the actual ransomware event.
MITRE ATT&CK
- Tactic
- Impact Discovery Lateral Movement
Sumo Detection Query
(_sourceCategory=*/Windows/Sysmon* OR _sourceCategory=*/WinEventLog/Security*)
| where (%"EventID" = "1" or %"EventID" = "4688" or EventID = 1 or EventID = 4688)
| parse field=_raw "Image: *\r" as Image nodrop
| parse field=_raw "CommandLine: *\r" as CommandLine nodrop
| parse field=_raw "Computer: *\r" as Computer nodrop
| parse field=_raw "User: *\r" as User nodrop
| parse field=_raw "NewProcessName: *\r" as NewProcessName nodrop
| parse field=_raw "CommandLine: *\r" as CommandLine2 nodrop
| if (isEmpty(Image), NewProcessName, Image) as ProcImage
| where (
(ProcImage matches "*vssadmin.exe" and (CommandLine matches "*delete*" or CommandLine matches "*shadowstorage*" or CommandLine matches "*resize*"))
or (ProcImage matches "*wmic.exe" and CommandLine matches "*shadowcopy*delete*")
or (ProcImage matches "*bcdedit.exe" and (CommandLine matches "*recoveryenabled*" or CommandLine matches "*bootstatuspolicy*"))
or (ProcImage matches "*powershell.exe" and (CommandLine matches "*Delete-ShadowCopy*" or CommandLine matches "*Win32_ShadowCopy*delete*"))
or ProcImage matches "*psexec.exe"
or ProcImage matches "*psexec64.exe"
or ProcImage matches "*paexec.exe"
or ProcImage matches "*remcom.exe"
or (ProcImage matches "*sc.exe" and (CommandLine matches "*stop*" or CommandLine matches "*delete*" or CommandLine matches "*config*")
and (CommandLine matches "*WinDefend*" or CommandLine matches "*SentinelAgent*"
or CommandLine matches "*CSFalconService*" or CommandLine matches "*MpsSvc*"
or CommandLine matches "*WdFilter*"))
or (ProcImage matches "*taskkill.exe" and (CommandLine matches "*msmpeng*" or CommandLine matches "*mssense*"
or CommandLine matches "*csagent*" or CommandLine matches "*sentinelagent*" or CommandLine matches "*cbdaemon*"))
or (ProcImage matches "*reg.exe" and (CommandLine matches "*DisableAntiSpyware*" or CommandLine matches "*DisableRealtimeMonitoring*")
and CommandLine matches "*Defender*")
)
| eval StagingIndicator = if(
(ProcImage matches "*vssadmin*" or ProcImage matches "*bcdedit*"
or (ProcImage matches "*wmic*" and CommandLine matches "*shadowcopy*")
or (ProcImage matches "*powershell*" and CommandLine matches "*ShadowCopy*")),
"ShadowCopyDeletion_CRITICAL",
if(ProcImage matches "*psexec*" or ProcImage matches "*paexec*" or ProcImage matches "*remcom*",
"RemoteExecTool_HIGH",
if(ProcImage matches "*sc.exe*" or ProcImage matches "*taskkill*" or ProcImage matches "*reg.exe*",
"DefenseImpairment_HIGH",
"StagingIndicator_MEDIUM")))
| eval RiskScore = if(StagingIndicator = "ShadowCopyDeletion_CRITICAL", 100,
if(StagingIndicator = "DefenseImpairment_HIGH", 90,
if(StagingIndicator = "RemoteExecTool_HIGH", 80, 60)))
| timeslice 30m
| stats
count as EventCount,
values(StagingIndicator) as Indicators,
max(RiskScore) as MaxRisk,
values(ProcImage) as Binaries,
values(CommandLine) as Commands
by _timeslice, Computer, User
| sort by MaxRisk descDetects ransomware pre-deployment staging in Sumo Logic by parsing Sysmon EID 1 and Windows Security EID 4688 process creation events. Covers shadow copy deletion (vssadmin/wmic/bcdedit/PowerShell), PsExec/PAExec/RemCom remote execution tool staging, and sc.exe/taskkill/reg.exe defense impairment against Windows Defender and third-party EDR agents. Groups into 30-minute timeslices with risk scoring (MaxRisk=100 for shadow deletion) to support analyst triage. Handles both Sysmon Image field and Security Log NewProcessName field via conditional normalization.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled backup jobs that invoke vssadmin to delete aged shadow copies as part of storage quota management or backup retention policy on backup infrastructure (Veeam proxies, DPM servers)
- Help desk or sysadmin use of PsExec or PAExec for legitimate remote task execution during routine support, software deployment, or authorized post-incident remediation across the domain
- Planned security tooling migrations where operations teams use sc.exe stop/delete to remove incumbent AV or EDR services before installing a replacement endpoint agent — common during quarterly platform refresh
Other platforms for THREAT-Ransomware-StagingIndicators
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Shadow Copy Deletion via vssadmin (Ransomware Staging Simulation)
Expected signal: Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
- Test 2 Windows Defender Disable via PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
Response Playbook
Triage
- Shadow copy deletion is a near-certain ransomware precursor — if vssadmin delete or wmic shadowcopy delete is detected, trigger incident response immediately without waiting for additional confirmation.
- Identify the user and process context: is this a service account, a domain admin, or a standard user? Ransomware staging almost always involves elevated privileges. Check how those privileges were obtained.
- Map the affected hosts: are multiple hosts showing staging indicators simultaneously? Multi-host staging indicates the attacker has already achieved domain compromise and is preparing for a domain-wide deployment.
- Check for PsExec or PAExec: the presence of these tools in unusual locations (C:\Users\, C:\ProgramData\, C:\Windows\Temp\) is a ransomware staging indicator even without shadow copy deletion.
- Review network traffic from affected hosts for bulk file access (the attacker may also be exfiltrating data before encryption — double extortion).
Containment
- Isolate affected endpoints via EDR host isolation immediately upon shadow copy deletion detection. Do not wait — encryption may begin within minutes.
- Block lateral movement: disable RDP, SMB, and WinRM to non-management hosts at the firewall if domain-wide staging is detected.
- Preserve shadow copies on unaffected systems immediately: run vssadmin create shadow /for=C: on all critical servers that haven't been affected.
- Force-disable any identified compromised accounts (domain admin accounts used for staging).
- Take offline backups: if you have offline/immutable backups, verify their integrity immediately and isolate backup infrastructure from the network.
Evidence Collection
- Process creation logs (Sysmon Event ID 1 or Security 4688) for all staging binaries
- Network file access logs: which shares were accessed, how many files, what size
- Authentication logs: which account(s) were used for PsExec/WMI remote execution
- EDR timeline for affected hosts: full process tree, file writes, network connections in 48h window before staging
- Active Directory logs: any privilege escalation or new account creation preceding staging
Escalation Criteria
- !Shadow copy deletion detected on any host — immediate incident declaration
- !PsExec or PAExec executed from unusual locations by unusual accounts
- !AV/EDR impairment attempts affecting multiple hosts
- !Staging indicators across 5+ hosts simultaneously — indicates domain-wide deployment preparation
- !Data staging directories created with large file counts (exfiltration before encryption)
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1 process creation for vssadmin, wmic, psexec, sc, taskkill - >
Windows Event ID 7040 (service disabled) for AV/EDR service impairment - >
File system: presence of staging binaries (psexec.exe, paexec.exe) in temp directories - >
Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender for Group Policy-level AV disablement - >
Network shares: SMB access logs showing bulk file reads from domain controller or file server (exfiltration)
Tuning Guidance
Shadow copy deletion is almost never a legitimate user action — the only expected sources are backup software service accounts (Veeam, Acronis, Windows Backup service). Create an exclusion list for those specific service account names and parent process names (e.g., VeeamBackupSvc, BackupExec). For PsExec, create allowlist exceptions for known IT admin accounts. The AV/EDR impairment detection has more potential for false positives from legitimate security tool upgrades — add exclusions for vendor-specific processes (CrowdStrike, Defender update processes). The key is treating shadow copy deletion as an immediate incident trigger, not a standard alert.
Hunting Queries
Hunt for shadow copy and backup deletion commands across the environment — any occurrence is high-priority given lack of legitimate use cases for these specific command patterns outside of authorised backup tooling.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
and ProcessCommandLine has_any ("delete", "shadowcopy", "shadow", "recoveryenabled")
| summarize Count=count(), Hosts=make_set(DeviceName)
by FileName, ProcessCommandLine
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\vssadmin.exe" OR Image="*\\wmic.exe" OR Image="*\\bcdedit.exe")
(CommandLine="*delete*" OR CommandLine="*shadow*" OR CommandLine="*recoveryenabled*")
| stats count AS Hits, dc(host) AS HostCount, values(host) AS Hosts
BY Image, CommandLine
| sort - HitsAtomic Red Team Tests
Deletes volume shadow copies using vssadmin — the most common ransomware staging indicator. This should be run in a sandbox environment only.
Command
vssadmin delete shadows /all /quietExpected Telemetry
Sysmon Event ID 1: vssadmin.exe process creation with 'delete shadows' in command line. Security Event ID 4688 if command line auditing enabled.
Expected Detection
Alert fires on ShadowCopyDeletion indicator with RiskScore=100. Immediate escalation required.
Disables Windows Defender real-time monitoring using PowerShell registry modification — a documented Akira and Black Basta staging step.
Command
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Cleanup
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $false"Expected Telemetry
Sysmon Event ID 1: powershell.exe with DisableRealtimeMonitoring in command line. Windows Defender event log records protection disabled.
Expected Detection
Alert fires on DefenseImpairment indicator. Cross-correlate with other staging indicators on same host.