<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ransomware-initial-access-vectors
description: >-
  Identify and monitor ransomware initial access vectors including phishing
  delivery, exploitation of public-facing applications (VPN, RDP, Exchange),
  supply chain compromise, and valid account abuse. Provides detection rules
  for email gateway logs, VPN authentication anomalies, and exposed service
  exploitation patterns.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - initial-access
  - phishing-detection
  - vpn-exploitation
  - rdp-brute-force
  - exchange-exploitation
  - supply-chain
  - credential-abuse
  - t1190
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1566"]
---

# Detecting Ransomware Initial Access Vectors

## Overview

Initial access is the first link in every ransomware chain. Modern
ransomware affiliates favor three primary vectors: exploitation of
public-facing applications (VPNs, Exchange, Citrix), phishing with
weaponized attachments or links, and abuse of valid credentials
(purchased from initial access brokers or stolen via infostealers).

Detecting initial access in real-time is the highest-ROI defense
investment. Every hour of earlier detection saves exponential cost.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Fail2ban | Brute-force detection | `apt install fail2ban` |
| Suricata | Network-level exploit detection | `apt install suricata` |
| GoPhish | Phishing simulation | GitHub release binary |
| Sigma CLI | Rule conversion | `pip install sigma-cli` |
| jq | JSON log parsing | `apt install jq` |

## Key Concepts

### Top Ransomware Initial Access Vectors (2024-2026)

```
Vector 1: VPN/RDP Exploitation (T1133, T1190)
  └─ Unpatched Fortinet, Pulse Secure, Citrix, SonicWall
  └─ Credential stuffing against VPN portals

Vector 2: Phishing (T1566.001, T1566.002)
  └─ Macro-enabled documents, ISO/LNK delivery
  └─ QR code phishing (quishing), callback phishing

Vector 3: Valid Accounts (T1078)
  └─ Credentials from infostealers (Raccoon, RedLine)
  └─ Initial access brokers (IABs) on dark web forums

Vector 4: Supply Chain (T1195)
  └─ Compromised MSP tools (Kaseya, ConnectWise)

Vector 5: Exposed Services (T1190)
  └─ Exchange ProxyShell/ProxyLogon, MOVEit, GoAnywhere
```

### Detection Fidelity by Vector

| Vector | MITRE ID | Detection Method | Confidence |
|--------|----------|-----------------|------------|
| VPN brute-force | T1110.001 | Auth log anomalies | High |
| Phishing delivery | T1566.001 | Email gateway + sandbox | Medium |
| Credential abuse | T1078 | Impossible travel | High |
| Exchange exploit | T1190 | Web shell detection | High |
| Supply chain | T1195 | Software integrity checks | Low |

## Workflow

### Step 1 — Monitor VPN/RDP Authentication Anomalies

```bash
# Detect brute-force attempts from auth logs
grep -iE "authentication failure|login failed" /var/log/auth.log \
  | awk '{print $1,$2,$3,$NF}' | sort | uniq -c | sort -rn | head -20

# Monitor for successful login after failures (credential stuffing success)
grep "Accepted" /var/log/auth.log | awk '{print $(NF-3), $NF}' | sort | uniq -c | sort -rn

# Check for impossible travel — same account from different sources
last -i | awk '{print $1, $3}' | sort | uniq -c | sort -rn | head -20
```

### Step 2 — Sigma Rules for Initial Access Detection

```yaml
title: VPN Portal Brute Force Detection
id: e2a7c8f1-4b3d-4a9e-b6c2-1d8f5e7a3b9c
status: stable
description: Detects rapid VPN authentication failures indicating brute-force
logsource:
  category: authentication
  product: generic
detection:
  selection:
    action: "failure"
    application|contains:
      - "vpn"
      - "sslvpn"
      - "fortivpn"
      - "globalprotect"
  timeframe: 5m
  condition: selection | count(source_ip) > 15
falsepositives:
  - Password rotation causing mass re-auth (correlate with change windows)
level: high
tags:
  - attack.initial_access
  - attack.t1110.001
```

```yaml
title: Exchange Web Shell Creation via ProxyShell
id: f3b8d9e2-5c4a-4b7f-a1e3-2c9d6f8b4a5e
status: stable
description: Detects web shell creation in Exchange directories
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\FrontEnd\HttpProxy\'
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
  filter_legit:
    Image|endswith: '\MSExchangeMailboxReplication.exe'
  condition: selection and not filter_legit
falsepositives:
  - Exchange cumulative update installations (whitelist CU window)
level: critical
tags:
  - attack.initial_access
  - attack.t1190
```

### Step 3 — Email Gateway Phishing Detection

```bash
# Parse email gateway logs for known phishing indicators
grep -iE '\.iso|\.img|\.lnk|\.one|\.xll|macro' /var/log/maillog \
  | grep -v "quarantined" | tail -50

# Analyze attachment hashes against threat intel
find /var/spool/mail/ -name "*.eml" -newer /tmp/last_check -exec \
  sha256sum {} \; | awk '{print $1}' | sort -u > /tmp/attachment_hashes.txt
```

### Step 4 — Exposed Service Vulnerability Scanning

```bash
# Check for known vulnerable services externally
nmap -sV -p 443,8443,4443 --script ssl-cert,http-title <EXTERNAL_IP> \
  --reason -oX external_scan.xml

# Check Exchange version for ProxyShell/ProxyLogon
curl -sk "https://<EXCHANGE>/owa/auth/logon.aspx" -o /dev/null -w "%{http_code}" \
  -D - 2>/dev/null | grep -i "x-owa-version"

# Monitor for exploitation attempts in web logs
grep -iE "autodiscover|mapi/nspi|powershell.*X-Rps-CAT" /var/log/httpd/access_log \
  | tail -20
```

## Verification

- [ ] VPN authentication logs monitored with brute-force threshold alerts
- [ ] Phishing simulation conducted monthly with GoPhish
- [ ] Exchange/Citrix/VPN patching verified within 48h of critical CVE release
- [ ] Impossible travel detection active for all privileged accounts
- [ ] Email gateway configured to detonate attachments in sandbox
- [ ] External attack surface scanned weekly for newly exposed services

## References

- MITRE ATT&CK T1190: Exploit Public-Facing Application
- MITRE ATT&CK T1566: Phishing
- MITRE ATT&CK T1078: Valid Accounts
- CISA Alert AA23-215A: Top Routinely Exploited Vulnerabilities
- Mandiant M-Trends: Initial Access Broker Trends
