# Ransomware Kill Chain & Detection Points
| Phase | Activity | Detection |
|-------|----------|-----------|
| 1. Initial Access | Phishing, RDP brute force, exploit | Email gateway, failed logins, IDS |
| 2. Execution | PowerShell, WMI, macro | Script block logging, AMSI |
| 3. Persistence | Scheduled tasks, services, registry | Sysmon Event 12/13, autoruns |
| 4. Discovery | AD enum, network scanning | Honeypots, unusual LDAP queries |
| 5. Lateral Movement | PsExec, RDP, WMI | Windows Event 4648, network flows |
| 6. Collection | Archive tools, staging dirs | Large file creation, compression |
| 7. Exfiltration | Cloud upload, DNS tunnel | DLP, unusual outbound traffic |
| 8. Impact | Encryption, shadow copy delete | Canary files, vssadmin monitoring |
