Hunting Ransomware Precursor Behavior

When to Use

• You have endpoint process/command telemetry and want to catch the steps ransomware takes before encrypting — deleting shadow copies, disabling recovery, killing security tools, and stopping backup/database services.
• You want early warning to intervene before payload detonation.

Do not use this as a substitute for blocking the encryption itself — it is an early-warning hunt for the preparation phase, not a recovery procedure.

Prerequisites

• Process-creation telemetry (with command line) and optionally service/file telemetry.

Workflow

Step 1: Hunt recovery-inhibition commands

python scripts/analyst.py hunt events.csv

Flags vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete catalog, bcdedit /set recoveryenabled no / bootstatuspolicy ignoreallfailures, and wevtutil cl.

Step 2: Detect defense and service tampering

Surface stopping/killing of AV/EDR and backup/DB services (net stop, taskkill, sc stop) targeting veeam, sql, backup, sophos, defender, etc.

Step 3: Correlate and prioritize

A host showing recovery-inhibition + service-stop in a short window is a high-priority pre-encryption signal — escalate immediately.

Step 4: Operationalize

Write a high-severity detection for shadow-copy deletion and recovery disabling.

Validation

• Recovery-inhibition commands are detected with their specific syntax.
• Security/backup service tampering is identified by target service names.
• Findings map to ATT&CK T1490 / T1489 (and precede T1486).

Pitfalls

• Admins occasionally delete shadow copies legitimately — corroborate with co-occurring tampering.
• LOLBin variants (wmic, PowerShell Get-WmiObject Win32_ShadowCopy | Remove) evading vssadmin-only rules.
• Fast attacks where precursor and encryption are near-simultaneous — alert must be real-time.

References

• See references/api-reference.md for the hunter.
• ATT&CK T1490 and T1486 (linked in frontmatter).