The ransom note is the last step, not the first. By the time files are encrypted, containment has already failed. The good news: crews telegraph their intent with loud precursors - if you're watching.
The pre-encryption playbook
- Initial access & foothold - phishing, exposed RDP/VPN, or a valid credential.
- Recovery inhibition - delete Volume Shadow Copies (
vssadmin delete shadows /all), stop backup services. This is the clearest tell. - Spread - move to as many hosts as possible (PsExec, WMI, SMB) so the detonation is maximal.
- Defense evasion - disable AV/EDR, clear logs.
- Detonation - only then does encryption run, often kicked off across hosts at once.
The detections that buy you time
- Shadow-copy deletion (
vssadmin/wbadmin) across hosts - alert loudly. - Mass file access from one account/host on a file server.
- EDR/AV being disabled, and 1102 log clears.
The right calls
When precursors fire, network-isolate the affected hosts immediately - don't wait to confirm encryption, and don't reboot (some families encrypt on boot). Assume domain-joined backups are in the blast radius; verify offline/immutable copies. Then scope the entry vector before restoring - or you'll just get re-encrypted.