Ransomware Reality Check: A Modern Defense & Response Playbook

CyberDefender 4 mins0

1) Ransomware Detection Rules Summary (SOC Playbook)

Goal: Identify behaviors commonly associated with ransomware execution, lateral movement, data staging, and encryption for impact.

A. Initial Access & Execution

1. Suspicious Email Attachment or Script Execution

  • Behavior: Office macro execution, script launch (PowerShell, Wscript/Cscript) from user email/cache directories.
  • MITRE: T1204 (User Execution), T1059 (Command/Scripting Interpreter)
  • Detections:
    • Child process of Outlook/Office spawning PowerShell or CMD.
    • Script files launched from temp or download folders.

B. Privilege Escalation & Credential Access

2. Credential Dumping Behaviors

  • Behavior: access to LSASS memory, suspicious handle requests, tools that interact with SAM/SECURITY hives.
  • MITRE: T1003 (Credential Dumping)
  • Detections:
    • Processes calling ReadProcessMemory on LSASS.
    • Unexpected creation of SAM/SECURITY hive copies.

C. Discovery & Lateral Movement

3. Abnormal Remote Service Execution

  • Behavior: PsExec/WMI/remote PowerShell used to distribute payloads.
  • MITRE: T1021 (Remote Services), T1059 (Remote PowerShell)
  • Detections:
    • Remote service creation events.
    • Unexpected powershell.exe -enc or winrm sessions from non-admin systems.

4. Network Share Enumeration

  • Behavior: scripted scanning for SMB shares or AD objects.
  • MITRE: T1087 (Account Discovery), T1135 (Network Share Discovery)
  • Detections:

    • High volume of net view, net group, LDAP queries, or SMB enumeration from a single endpoint.

D. Data Staging & Exfiltration

5. Sudden Large File Compression

  • Behavior: mass use of zip, 7z, rar, or custom packers.
  • MITRE: T1074 (Data Staging), T1560 (Archive Collected Data)
  • Detections:
    • Large archives created in short time.
    • Compression tools executed by accounts that do not normally use them.

6. Data Exfiltration Channel Creation

  • Behavior: outbound connections to cloud storage or TOR relays.
  • MITRE: T1041 (Exfiltration Over C2 Channel), T1090 (Proxy/TOR)
  • Detections:
    • TOR client indicators (known exit nodes).
    • Upload spikes to unfamiliar cloud or FTP/SFTP endpoints.

E. Ransomware Activation & Encryption for Impact

7. Shadow Copy Deletion or Backup Tampering

  • Behavior: attempts to destroy local recovery options.
  • MITRE: T1490 (Inhibit System Recovery)
  • Detections:
    • Commands such as vssadmin delete shadows or wbadmin delete.
    • Unexpected backup service stoppage.

8. Mass File Renames / Rapid I/O Activity

  • Behavior: sudden modification or renaming of hundreds of files in seconds.
  • MITRE: T1486 (Data Encrypted for Impact)
  • Detections:
    • EDR detection: high-rate file writes by processes not normally performing I/O-heavy operations.
    • Creation of ransom note files across directories.

F. Command & Control Indicators

9. Encrypted or Beaconing Traffic to Unknown Hosts

  • Behavior: consistent periodic connections, domain-generation algorithm patterns.
  • MITRE: T1071 (C2 Communications)
  • Detections:
    • Identical packet sizes at regular intervals.
    • DNS requests for high-entropy subdomains.

SOC Alerting Matrix (Rule → Log Source → Severity → MITRE ATT&CK ID)

CyberDefender