<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ransomware-staging-behavior
description: >-
  Detect ransomware pre-encryption staging activities including data
  exfiltration preparation, archive creation for double extortion,
  encryption key staging, service stopping for file unlock, and mass file
  enumeration patterns. Provides behavioral detection rules for the
  critical window between compromise and encryption.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - staging-detection
  - pre-encryption
  - data-exfiltration
  - archive-creation
  - service-stopping
  - file-enumeration
  - double-extortion
  - behavioral-detection
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1074"]
---

# Detecting Ransomware Staging Behavior

## Overview

The staging phase is the last window to stop ransomware before encryption.
During staging, operators exfiltrate data for double extortion, stop
services that lock files (databases, Exchange, backup agents), enumerate
file systems for targeting, stage encryption keys, and prepare ransom
notes. This phase typically lasts 1-4 hours and produces distinctive
behavioral patterns.

Detecting staging behavior is the last reliable chance to prevent data
loss. After encryption begins, you are in incident response mode.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Sysmon | Process and file telemetry | `sysmon64 -i config.xml` |
| auditd | Linux audit framework | `apt install auditd` |
| inotifywait | Real-time file monitoring | `apt install inotify-tools` |
| Sigma CLI | Rule conversion | `pip install sigma-cli` |
| YARA | Pattern matching | `pip install yara-python` |

## Key Concepts

### Staging Behavior Timeline

```
T-4h: Data Discovery — mass file enumeration, size calculation
T-3h: Data Exfiltration — archive creation (7z, rar), cloud upload
T-2h: Service Disruption Prep — enumerate running services
T-1h: Defense Disabling — stop EDR, disable Defender, clear logs
T-0:  Encryption Launch — drop ransom note, begin encryption
```

### High-Fidelity Staging Indicators

| Indicator | MITRE ID | Detection Fidelity | FP Rate |
|-----------|----------|-------------------|---------|
| Mass service stopping | T1489 | Critical | Low |
| Archive + upload combo | T1560 + T1567 | Critical | Low |
| bcdedit recovery disable | T1490 | Critical | Very Low |
| Rapid file enumeration | T1083 | Medium | Medium |
| Ransom note creation | T1486 | Critical | Very Low |

## Workflow

### Step 1 — Detect Mass Service Stopping

```yaml
# Sigma: Mass Service Stop Indicating Ransomware Staging
title: Mass Service Stop Indicating Ransomware Staging
id: d7e3b1a4-9c2f-4d8e-b5a1-3f7c6e2d8b4a
status: stable
description: Detects multiple services stopped in short timeframe
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7036
    param1|contains:
      - "stopped"
  filter_maintenance:
    param2|contains:
      - "Windows Update"
      - "BITS"
  timeframe: 5m
  condition: selection and not filter_maintenance | count() > 5
falsepositives:
  - Planned maintenance windows (correlate with change management)
level: critical
tags:
  - attack.impact
  - attack.t1489
```

```bash
# Linux: Monitor service stops
journalctl -u '*' --since "1 hour ago" | grep -i "stopped\|deactivating" | \
  awk '{print $NF}' | sort | uniq -c | sort -rn | head -20
```

### Step 2 — Detect Data Staging and Exfiltration

```bash
# Detect archive creation in suspicious locations
find /tmp /var/tmp /dev/shm -name "*.7z" -o -name "*.rar" -o -name "*.zip" \
  -newer /tmp/.staging_check 2>/dev/null

# Monitor for rclone/mega usage (common exfil tools)
ps aux | grep -iE "rclone|megacmd|megasync|winscp|filezilla" | grep -v grep

# Detect large outbound transfers
ss -tnp | awk '$3 > 1000000 {print $0}' 2>/dev/null

# inotifywait: Real-time monitoring for archive creation
inotifywait -m -r --format '%w%f %e' -e create -e modify \
  /tmp /var/tmp 2>/dev/null | grep -iE '\.7z$|\.rar$|\.zip$|\.tar'
```

### Step 3 — Detect File System Enumeration Patterns

```bash
# auditd rules for mass file access
cat << 'AUDIT'
# /etc/audit/rules.d/ransomware-staging.rules
-a always,exit -F arch=b64 -S openat -F dir=/home -F success=1 -F key=mass_enum
-a always,exit -F arch=b64 -S getdents -F key=dir_listing
AUDIT

# Search audit logs for enumeration patterns
ausearch -k mass_enum --start recent 2>/dev/null | \
  awk '/name=/{print $NF}' | sort | uniq -c | sort -rn | head -20
```

### Step 4 — KQL for Staging Detection in Sentinel

```kql
// Detect ransomware staging — service stopping pattern
Event
| where EventLog == "System" and EventID == 7036
| where RenderedDescription has "stopped"
| summarize ServicesStopped=count() by Computer, bin(TimeGenerated, 5m)
| where ServicesStopped > 5

// Detect archive creation followed by network upload
DeviceFileEvents
| where FileName endswith_cs ".7z" or FileName endswith_cs ".rar"
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort in (443, 8443, 21)
    | where RemoteUrl has_any ("mega.nz", "rclone", "transfer.sh")
) on DeviceId
| where TimeGenerated1 between (TimeGenerated .. (TimeGenerated + 1h))
```

## Verification

- [ ] Service stopping alerts fire within 60 seconds of mass stop events
- [ ] Archive creation in temp directories triggers immediate alert
- [ ] Outbound transfer anomaly detection active for >100MB transfers
- [ ] File enumeration rate monitoring configured (>1000 files/min threshold)
- [ ] Ransomware staging detection tested against Atomic Red Team
- [ ] Automated containment triggers configured for high-confidence staging

## References

- MITRE ATT&CK T1489: Service Stop
- MITRE ATT&CK T1560: Archive Collected Data
- MITRE ATT&CK T1567: Exfiltration Over Web Service
- MITRE ATT&CK T1083: File and Directory Discovery
- DFIR Report: Ransomware Staging Analysis
