<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ransomware-precursors
description: >-
  Detect early-stage ransomware activity before encryption begins. Covers
  identification of Cobalt Strike beacons, RDP brute-force attempts, credential
  harvesting (Mimikatz, LSASS dumps), VSS shadow copy deletion, backup
  tampering, and reconnaissance tools (AdFind, BloodHound, SharpHound).
  Provides Sigma rules, KQL queries, and Splunk SPL for each precursor.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - ransomware-precursors
  - cobalt-strike
  - detection-engineering
  - sigma-rules
  - threat-hunting
  - lsass
  - vss-deletion
  - lateral-movement
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Detecting Ransomware Precursors

## Overview

Ransomware operators spend days to weeks inside a network before deploying
encryption. This dwell time creates detection windows. By identifying
precursor behaviors — C2 beaconing, credential theft, reconnaissance, and
backup tampering — defenders can contain the threat before data loss occurs.

Average dwell time for ransomware groups: 5–21 days (Mandiant M-Trends).
Detection at any stage before encryption is a win.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Sysmon | Endpoint telemetry | `sysmon64 -i sysmonconfig.xml` |
| Sigma CLI | Rule conversion | `pip install sigma-cli` |
| Hayabusa | EVTX timeline | GitHub release binary |
| Chainsaw | Log hunting | GitHub release binary |
| Velociraptor | Endpoint collection | Server + client deploy |
| YARA | File/memory scanning | `pip install yara-python` |

## Key Concepts

### Precursor Kill Chain Stages

```
Stage 1: Initial Access (T1566, T1190, T1133)
  └─ Phishing emails, VPN/RDP exploits, exposed services

Stage 2: C2 Establishment (T1071, T1095, T1572)
  └─ Cobalt Strike, Sliver, Brute Ratel beacons

Stage 3: Credential Access (T1003, T1558, T1110)
  └─ LSASS dumps, Kerberoasting, DCSync

Stage 4: Discovery & Lateral Movement (T1018, T1021, T1047)
  └─ AdFind, BloodHound, PsExec, WMI, WinRM

Stage 5: Defense Evasion (T1562, T1070, T1027)
  └─ EDR tampering, log clearing, obfuscation

Stage 6: Pre-Encryption Staging (T1490, T1489)
  └─ VSS deletion, backup agent stop, service disabling
```

### Detection Priority Matrix

| Precursor | MITRE ID | Detection Fidelity | FP Rate |
|-----------|----------|-------------------|---------|
| VSS shadow deletion | T1490 | High | Low |
| LSASS access | T1003.001 | High | Medium |
| Cobalt Strike beacon | T1071.001 | Medium | Low |
| AdFind execution | T1018 | High | Low |
| Backup service stop | T1489 | High | Low |
| Mass RDP logon | T1021.001 | Medium | Medium |
| PsExec service install | T1021.002 | High | Medium |

## Workflow

### Step 1 — Deploy Sysmon for Precursor Telemetry

```xml
<!-- Sysmon config snippet — ransomware precursor focus -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <!-- LSASS access (T1003.001) -->
    <ProcessAccess onmatch="include">
      <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
    </ProcessAccess>
    <!-- Shadow copy deletion (T1490) -->
    <ProcessCreate onmatch="include">
      <CommandLine condition="contains any">vssadmin delete;wmic shadowcopy delete;bcdedit /set {default} recoveryenabled no</CommandLine>
    </ProcessCreate>
    <!-- Reconnaissance tools (T1018) -->
    <ProcessCreate onmatch="include">
      <Image condition="contains any">AdFind;SharpHound;BloodHound;nltest;dsquery</Image>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>
```

### Step 2 — Sigma Rules for Precursor Detection

```yaml
# Sigma: Cobalt Strike Named Pipe
title: Cobalt Strike Default Named Pipe Detection
id: a3e9f4b2-1c8d-4e7a-b5f6-2d9c8e3a7b1f
status: stable
description: Detects default Cobalt Strike named pipes used for C2 communication
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|startswith:
      - '\MSSE-'
      - '\postex_'
      - '\postex_ssh_'
      - '\status_'
  condition: selection
falsepositives:
  - Custom applications using similar pipe naming (verify binary)
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
```

```yaml
# Sigma: LSASS Memory Access for Credential Dumping
title: LSASS Memory Access via Suspicious Process
id: b7d2e5a1-3f9c-4b8e-a1d6-5e4c7f2b8d3a
status: stable
description: Detects non-standard processes accessing LSASS memory
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
  filter_legitimate:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
      - '\wininit.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - EDR agents with deep inspection (add to filter)
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
```

### Step 3 — KQL Queries for Sentinel

```kql
// Detect VSS shadow copy deletion
DeviceProcessEvents
| where ProcessCommandLine has_any ("vssadmin delete shadows",
    "wmic shadowcopy delete", "bcdedit /set recoveryenabled no",
    "wbadmin delete catalog")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc

// Detect reconnaissance tool execution
DeviceProcessEvents
| where FileName in~ ("AdFind.exe", "SharpHound.exe", "BloodHound.exe",
    "nltest.exe", "dsquery.exe", "adfind.exe")
    or ProcessCommandLine has_any ("domainlist", "trustdmp", "dcmodes",
    "-CollectionMethod All")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

// Detect mass RDP lateral movement
DeviceLogonEvents
| where LogonType == "RemoteInteractive"
| summarize HostCount = dcount(DeviceName) by AccountName, bin(Timestamp, 1h)
| where HostCount > 5
```

### Step 4 — Splunk SPL for On-Prem SIEM

```spl
| Search for backup service tampering
index=windows sourcetype=WinEventLog:System EventCode=7036
  (Service_Name="Volume Shadow Copy" OR Service_Name="Windows Backup"
   OR Service_Name="Veeam*" OR Service_Name="Commvault*")
  Message="*stopped*"
| stats count by _time, host, Service_Name

| Search for PsExec service installation
index=windows sourcetype=WinEventLog:System EventCode=7045
  Service_Name="PSEXESVC"
| stats count by _time, host, Account_Name, Service_File_Name
```

### Step 5 — Hunt with Hayabusa and Chainsaw

```bash
# Hayabusa — timeline ransomware precursors
hayabusa csv-timeline -d /path/to/evtx/ -o precursors.csv \
  --min-level high

# Filter for ransomware-specific indicators
grep -iE "shadow|vssadmin|bcdedit|psexec|mimikatz|lsass|cobalt" \
  precursors.csv | sort -t, -k1

# Chainsaw — hunt for specific precursors
chainsaw hunt /path/to/evtx/ --rules sigma/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --output precursor-hits.json
```

## Verification

- [ ] Sysmon configured to capture LSASS access, process creation, pipe events
- [ ] Sigma rules deployed for VSS deletion, LSASS access, recon tools
- [ ] KQL/SPL queries returning results in SIEM within SLA
- [ ] Hayabusa timeline tested against known ransomware EVTX samples
- [ ] Alert response playbook documented for each precursor type
- [ ] False positive baseline established for environment

## References

- MITRE ATT&CK T1486: Data Encrypted for Impact
- MITRE ATT&CK T1490: Inhibit System Recovery
- MITRE ATT&CK T1003.001: LSASS Memory
- Mandiant M-Trends Report: Dwell Time Metrics
- CISA Alert AA22-321A: Ransomware Precursor Activity
