<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ransomware-emulation
description: >-
  Safely emulate ransomware behavior to test detection and response capabilities
  including file enumeration, safe encryption simulation, ransom note deployment,
  and shadow copy deletion detection without causing actual data loss.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - ransomware-emulation
  - impact-simulation
  - detection-testing
  - incident-response
  - data-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486", "T1490", "T1489", "T1529"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["python3", "atomic-red-team"]
---

# Performing Ransomware Emulation

## Overview

Ransomware emulation tests organizational readiness against encryption-based
attacks without risking actual data loss. Safe emulation techniques simulate
file enumeration, encryption behavior patterns, ransom note creation, and
backup destruction to validate detection rules, backup integrity, and incident
response procedures.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `Atomic Red Team` | Security tooling |
| Isolated test environment with sample data (never production) | Environment requirement |
| Backup verification procedures documented | Environment requirement |
| IR team notified and monitoring during exercise | Environment requirement |

## Workflow

### Step 1: Safe Encryption Simulation

```python
"""Safe ransomware emulation — XOR-based reversible encryption on test files."""
import os
from pathlib import Path

SAFE_KEY = b"\x42"  # Single-byte XOR — trivially reversible
MARKER = b"EMULATION_SAFE"

def safe_encrypt(target_dir: str, extensions: list[str]) -> dict:
    """Encrypt test files with reversible XOR — never use on real data."""
    encrypted = []
    for ext in extensions:
        for fpath in Path(target_dir).rglob(f"*{ext}"):
            data = fpath.read_bytes()
            xored = bytes(b ^ SAFE_KEY[0] for b in data)
            fpath.write_bytes(MARKER + xored)
            encrypted.append(str(fpath))
    return {"encrypted": len(encrypted), "files": encrypted}
```

### Step 2: Ransom Note Deployment

```bash
# Deploy simulated ransom notes
node scripts/agent.js deploy-notes --directory /test/share --template "EMULATION_README.txt"

# Monitor for detection of ransom note creation
node scripts/agent.js monitor-detection --indicator "ransom_note"
```

### Step 3: Shadow Copy Deletion Detection

```bash
# Test detection of shadow copy deletion (Windows)
# vssadmin delete shadows /all /quiet  # EMULATION — log only, do not execute
node scripts/agent.js test-vss-detection --mode dry-run

# Test detection of backup service disruption
node scripts/agent.js test-backup-detection --services "vss,wbengine,swprv"
```

### Step 4: Recovery Validation

```bash
# Verify backup restoration works
node scripts/agent.js validate-recovery --backup-path /backups/latest --target /test/restore

# Generate emulation report
node scripts/agent.js report --execution-log emulation.json
```

## Detection

```yaml
title: Ransomware Emulation Detection
id: 069c5d2d-a284-4866-a04a-c9ca6d237fc5
status: experimental
description: Detects suspicious activity related to performing ransomware emulation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*ransomware*"
  condition: selection
level: high
tags:
  - attack.t1486
  - attack.t1490
  - attack.t1489
  - attack.t1529
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Ransomware Emulation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1486, T1490, T1489, T1529 |

## Verification

- [ ] Encryption simulation uses reversible safe method only
- [ ] Test environment isolated from production data
- [ ] Detection rules triggered for file encryption patterns
- [ ] Ransom note creation detected by endpoint monitoring
- [ ] Shadow copy deletion attempt detected
- [ ] Backup recovery validated successfully

## References

- [Atomic Red Team T1486](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1486/) — Ransomware tests
- [CISA Ransomware Guide](https://www.cisa.gov/stopransomware) — Response guidance
