<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Ransomware Staging Behavior — API Reference

## auditd Rules for Staging Detection

```bash
# Add mass enumeration monitoring
auditctl -a always,exit -F arch=b64 -S openat -F dir=/home -F key=mass_enum
auditctl -a always,exit -F arch=b64 -S getdents -F key=dir_listing

# Search audit logs
ausearch -k mass_enum --start recent
ausearch -k file_create --start today

# Generate audit report
aureport --file --start today --summary
```

## inotifywait Monitoring

```bash
# Watch for archive creation
inotifywait -m -r --format '%w%f %e %T' --timefmt '%H:%M:%S' \
  -e create -e modify /tmp /var/tmp

# Watch specific extensions
inotifywait -m -r --include '\.(7z|rar|zip|enc)$' \
  -e create /tmp /var/tmp /home
```

## Process Monitoring

```bash
# Monitor for exfiltration tools
watch -n 5 'ps aux | grep -iE "rclone|mega|winscp|curl.*upload" | grep -v grep'

# Monitor network connections for large transfers
watch -n 5 'ss -tnp | awk "$3 > 500000 {print}"'
```

## Sigma Rule Conversion

```bash
# Convert staging rules to Splunk
sigma convert -t splunk -p splunk_cim staging_rules/*.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows staging_rules/*.yml
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `watch_path` | Directory to monitor | `/tmp` |
| `threshold` | Service stop count trigger | `5` |
| `timeframe` | Detection window | `5m` |
| `archive_extensions` | Suspicious file types | `.7z,.rar,.zip` |
