🔎 Last updated · Editorial policy · Report an error
TL;DR: Yes, You Can Catch Ransomware Before Encryption Starts
Shadow copy deletion, mass file writes, and ransom note drops are all detectable before encryption completes—using Sysmon Event IDs 1, 11, 23 plus scheduled Velociraptor VQL hunts. This lab walks you through simulating each behavior safely and building detection for it.
Why Pre-Encryption Behavior Is Your Best Detection Window
Modern ransomware is not a single event—it’s a kill chain. CISA’s #StopRansomware guides describe a consistent sequence: initial access, reconnaissance, privilege escalation, defense evasion, persistence, then—only at the end—impact. That final encryption stage is what most organizations detect, because that’s when users scream and EDR blocks light up. By then, the attacker has hours or days of dwell time banked, and your negotiating position is gone.
The pre-encryption stages are far more reliable hunting ground. Consider the trade-off: post-encryption alerts rely on file entropy spikes or extension changes—after the damage. Pre-encryption behaviors are louder and harder to disguise:
- Defense evasion (MITRE ATT&CK T1490 — Inhibit System Recovery): Deleting volume shadow copies via
vssadmin,wmic, or PowerShell is near-universal across ransomware families. Legitimate processes almost never do this from a user context. - Impact staging (T1486 — Data Encrypted for Impact): Mass file writes and renames produce a distinctive Event ID 11/Event ID 2 velocity signature in Sysmon.
- Extortion preparation: Dropping ransom notes (Event ID 11) and registry persistence keys (Event ID 13) happens before or during encryption—giving you a second chance to catch it mid-operation.
Better windows mean better outcomes. Detection at the shadow-copy-deletion stage can stop the incident before impact; detection after encryption is a forensics exercise. CISA’s joint advisories repeatedly list vssadmin delete shadows /all /quiet among the first commands executed by deployed implants—that’s your tripwire.
Lab Setup: Windows VM, Sysmon Config, and Velociraptor Install
You need an isolated Windows 10/11 VM (snapshots enabled, no production network access), Sysmon 15.x, and Velociraptor 0.7.x. Verify network isolation first—you are deliberately executing ransomware-adjacent behavior on this host.
Install Sysmon
Download Sysinternals Sysmon and the SwiftOnSecurity baseline configuration, which is the community-standard starting point:
# From an elevated PowerShell in the lab VM
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Sysmon.zip" -OutFile Sysmon.zip
Expand-Archive Sysmon.zip -DestinationPath C:ToolsSysmon
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -OutFile C:Toolssysmonconfig.xml
C:ToolsSysmonSysmon64.exe -accepteula -i C:Toolssysmonconfig.xml
The SwiftOnSecurity config covers Event ID 1 (process creation with full command line), Event ID 2 (file creation time changed), Event ID 11 (file create), Event ID 13 (registry set), and Event ID 23 (file delete)—exactly the telemetry ransomware hunting needs.
Install Velociraptor
Invoke-WebRequest -Uri "https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor-v0.7.2-windows-amd64.msi" -OutFile C:Toolsvelociraptor.msi
msiexec /i C:Toolsvelociraptor.msi /qn
For a single-host lab, the MSI’s standalone/server mode with the built-in GUI at https://localhost:8889 is fine. Confirm the Velociraptor client appears under the Clients view. If you’re new to the tool’s artifact and VQL model, our Velociraptor DFIR primer covers the basics.
Simulating Tactic 1: Shadow Copy Deletion with vssadmin and wmic
First create a shadow copy so there’s something to delete, then run the classic ransomware commands from an elevated prompt:
wmic shadowcopy call create Volume='C:'
vssadmin delete shadows /all /quiet
wmic shadowcopy delete
In Event Viewer under Applications and Services Logs > Microsoft > Windows > Sysmon > Operational, each command generates Event ID 1 (Process Create) with the full command line visible in the event’s CommandLine field. You’ll also see Event ID 13 evidence from vssadmin touching service-related registry keys. Screenshot or export these—they’re your ground truth for validation later. Note the exact process names and parent processes (cmd.exe spawning vssadmin.exe) since parent-child anomalies are half the detection value.
Simulating Tactic 2: Batch Encryption and Mass File Modifications
Real ransomware reads, encrypts, writes, and renames files at high velocity. You can simulate the telemetry signature—without actual crypto—by writing and renaming files in bulk:
$target = "C:\Users\labuser\Documents\simdata"
New-Item -ItemType Directory -Path $target -Force | Out-Null
1..500 | ForEach-Object {
$f = Join-Path $target "file$_.txt"
Set-Content -Path $f -Value ("A" * 4096)
Rename-Item -Path $f -NewName ("file$_.txt.locked")
}
This produces ~500 Event ID 11 (File Create) events plus ~500 Event ID 2 (File creation time changed / rename) events in rapid succession—tens of seconds of write velocity that no normal user workflow produces. Browse a large photo library or extract an archive to establish your baseline for contrast; normal activity is orders of magnitude slower and concentrated in predictable directories.
Simulating Tactic 3: Ransom Note Dropping
Ransomware families drop notes—README, DECRYPT, HOW_TO_RECOVER, etc.—into every traversed directory, and some variants write recovery-related registry values. Simulate it:
Get-ChildItem C:\Users\labuser -Directory | ForEach-Object {
Copy-Item C:ToolsREADME_RESTORE.txt (Join-Path $_.FullName "README_RESTORE.txt") -Force
}
New-Item -Path "HKCU:SoftwareLockBit-Sim" -Force | Out-Null
Set-ItemProperty -Path "HKCU:SoftwareLockBit-Sim" -Name "Encrypted" -Value "ALL FILES"
Each file copy fires Event ID 11; the registry write fires Event ID 13 with TargetObject and Details populated. Combined with the write-velocity spike from Tactic 2, a ransom-note name pattern is a high-confidence impact indicator.
Writing the Velociraptor Hunt: VQL Queries for Each Behavior
Velociraptor’s power is hunting across endpoints with VQL. Create a new hunt and add these custom artifacts. First, suspicious process creations (Event ID 1 via the Windows.Sysmon.Events-style artifact or the built-in Windows.Detection.Sysmon pattern):
SELECT Timestamp, process_name AS ProcName,
command_line AS CommandLine,
parent_process_name AS Parent, User
FROM source(
artifact="Windows.Sys.Events.ProcessCreation")
WHERE command_line =~ "(?i)vssadmin.+delete shadows"
OR command_line =~ "(?i)shadowcopy delete"
OR command_line =~ "(?i)bcdedit.+recoveryenabled"
Next, ransom note drops — hunt file names by pattern:
SELECT FullPath, Size, Timestamp
FROM watch_sysmon_filecreate()
WHERE Name =~ "(?i)(readme|decrypt|restore|how_to).*(txt|hta|html)"
Finally, write-velocity spikes — aggregate Event ID 11 counts per process over a sliding window:
SELECT process_name, count() AS Writes
FROM source(artifact="Windows.Sysmon.FileCreate")
WHERE Timestamp > timestamp(epoch=now() - 300)
GROUP BY process_name
HAVING Writes > 200
A process writing hundreds of files in five minutes is your mass-encryption tripwire. Tune the threshold against your baseline before production.
Building Sigma Rules for Each Technique
Map each behavior to Sigma YAML so it ports to your SIEM. T1490 process detection:
title: Shadow Copy Deletion via vssadmin or wmic
id: e17d7f6d-4e6a-4b1a-9c1e-000000000001
status: experimental
description: Detects shadow copy deletion, MITRE ATT&CK T1490
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 1
CommandLine|contains|all:
- 'delete'
- 'shadows'
condition: selection
tags:
- attack.defense_evasion
- attack.t1490
- attack.impact
- attack.t1486
falsepositives:
- Legitimate backup and recovery software
level: high
Repeat the pattern for ransom note file creates (Event ID 11 with filename regex) tagged attack.t1486. Convert with sigmac to your backend—--target splunk, --target lucene, or --target kusto for Sentinel. The Sigma project’s official rule repository includes well-tested T1490 rules worth comparing against yours.
Validating the Hunts Against Your Lab Artifacts
Run each simulation, then execute your Velociraptor hunts. Expected results:
- Simulation 1: Two Event ID 1 hits for
vssadmin.exeandwmic.exewith the exact command lines, parented by your elevated shell. - Simulation 2: The velocity query flags
powershell.exewith 500+ writes—your only process above threshold. - Simulation 3: Eleven Event ID 11 hits matching the note regex, plus one Event ID 13 registry write.
Triage discipline: check the process signer, path, and parent-child chain. A shadow-copy deletion from C:Program FilesVeeam under a service account is a different animal from the same command spawned by cmd.exe under a user session following suspicious logons. Context, not the single event, determines true positive.
Hardening: Detection Gaps, Noise Tuning, and Next Steps
Your lab will produce false positives. The biggest: legitimate backup software. Veeam, Acronis, Windows Server Backup, and storage snapshots all delete or manage shadow copies. Tune by:
- Excluding signed backup binaries from known install paths (Sysmon Event ID 1 gives you
SignedandCompanyfields for exactly this) - Alerting harder on user-context execution of recovery-wiping commands
- Correlating shadow-copy deletion with file-write velocity—backup tools don’t encrypt 500 files in 60 seconds
Logging gaps to close: enable Event ID 23 (file delete) for ransom-note cleanup detection, enable PowerShell Script Block Logging (4104) for obfuscated Get-WmiObject Win32_ShadowCopy variants, and consider Sysmon Event ID 9 (raw disk access) if your config excludes it. Extend the hunt with canary files—planted decoys in sensitive shares that trigger instantly when touched—and watch our Kerberoasting detection guide for the credential-access stage that almost always precedes ransomware deployment.
Frequently Asked Questions
Do I need Sysmon installed on every endpoint for Velociraptor hunts to work?
No, but it matters. Velociraptor can hunt using native Windows event logs and its own client monitoring artifacts without Sysmon—process tracking via Windows.Sys.Events and filesystem analysis still function. However, without Sysmon you lose full command lines, file hashes, parent-child process linkage, and reliable file-create/delete telemetry—meaning you’ll catch far less detail and more sophisticated ransomware will blend in. Deploy Sysmon broadly; treat Sysmon-less coverage as best-effort fallback.
Is Velociraptor free and safe to run in production?
Yes. Velociraptor is open source under the AGPL and is sponsored by Rapid7, which acquired Velocidex in 2021. It’s a mainstay of DFIR teams worldwide and scales to tens of thousands of endpoints. Production considerations: secure the server’s TLS certificates and API access, size the datastore for event artifact volume, and stage agent rollouts—client monitoring artifacts with aggressive filesystem queries can generate meaningful load on file-server workloads.
What commands do real ransomware families use to delete shadow copies?
Commonly observed across CISA advisories and incident response reports: vssadmin delete shadows /all /quiet, wmic shadowcopy delete, PowerShell Get-WmiObject Win32_ShadowCopy | Remove-WmiObject, and bcdedit /set recoveryenabled no to kill boot recovery. Hunt all four variants—many families rotate between them if one is blocked.
How do I reduce false positives from legitimate backup software?
Whitelist known backup process paths and signers, alert aggressively only on user-context execution of recovery-destruction commands, and correlate shadow-copy deletion with file-write velocity. A signed Veeam binary deleting shadows on a schedule with no encryption activity is normal; unsigned cmd.exe deleting shadows while a process renames hundreds of files is an incident.
What file-write rate should trigger a mass encryption alert?
There is no universal number. Start from a lab baseline—our simulation produced 500 writes/renames in under a minute, while typical user activity rarely exceeds a few writes per minute on the same directories. A practical starting threshold: hundreds of file creates or renames per process within a 1–5 minute window. Tune downward for file servers (higher baseline) and validate against your environment’s normal churn before enforcing.
Can Velociraptor detect ransomware fast enough to stop encryption? Yes—with client monitoring artifacts and real-time VQL watches, detection latency is seconds, and Velociraptor supports quarantine and response actions via hunt or server-initiated flows. It’s not a replacement for EDR’s inline blocking, but as a hunt and response layer it can absolutely interrupt a ransomware operation mid-encryption.
