<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Ransomware Precursors — API Reference

## Sysmon Event IDs

| Event ID | Description | Precursor Relevance |
|----------|-------------|-------------------|
| 1 | Process creation | Recon tools, VSS deletion commands |
| 3 | Network connection | C2 beacon callbacks |
| 7 | Image loaded | DLL injection for credential theft |
| 10 | Process access | LSASS memory access |
| 11 | File create | Ransomware binary drop |
| 17/18 | Pipe created/connected | Cobalt Strike named pipes |

## Windows Event IDs

| Event ID | Log | Precursor Indicator |
|----------|-----|-------------------|
| 4624 | Security | Logon events (Type 10 = RDP) |
| 4648 | Security | Explicit credential logon (lateral movement) |
| 4662 | Security | Directory service access (DCSync) |
| 7036 | System | Service state change (backup stop) |
| 7045 | System | Service installation (PsExec) |
| 1102 | Security | Audit log cleared |

## Hayabusa Commands

```bash
# Full precursor timeline
hayabusa csv-timeline -d /evtx/ -o timeline.csv --min-level medium

# Filter for lateral movement
hayabusa csv-timeline -d /evtx/ -o lateral.csv \
  --min-level high -r rules/lateral_movement/

# JSON output for SIEM ingestion
hayabusa json-timeline -d /evtx/ -o precursors.jsonl
```

## Chainsaw Commands

```bash
# Hunt with Sigma rules
chainsaw hunt /evtx/ --rules sigma/ \
  --mapping mappings/sigma-event-logs-all.yml

# Search for specific indicators
chainsaw search /evtx/ --string "vssadmin" --string "PSEXESVC"

# Dump specific event IDs
chainsaw dump /evtx/ --event-id 7045 --event-id 4648
```

## Sigma CLI Conversion

```bash
# Convert to Splunk
sigma convert -t splunk -p splunk_cim rules/vss_deletion.yml

# Convert to Elastic/KQL
sigma convert -t elasticsearch -p ecs_windows rules/lsass_access.yml

# Convert to Microsoft Sentinel
sigma convert -t kusto -p microsoft365defender rules/recon_tools.yml
```

## CrowdStrike Falcon API — IOC Hunt

```bash
# Search for process indicators
curl -s "https://api.crowdstrike.com/indicators/queries/iocs/v1?types=sha256" \
  -H "Authorization: Bearer $CS_TOKEN"

# Real-time response — check for precursor files
curl -s "https://api.crowdstrike.com/real-time-response/entities/sessions/v1" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"device_id": "DEVICE_ID", "command_string": "ls C:\\Temp\\*.exe"}'
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `evtx_path` | Directory with Windows EVTX logs | `/evidence/evtx/` |
| `sigma_rules` | Path to Sigma rule directory | `./rules/ransomware/` |
| `min_level` | Minimum alert severity | `high`, `critical` |
| `timeframe` | Detection window lookback | `24h`, `7d` |
