Threat Hunting Exercise: Analyzing Ransomware Shadow Copy Deletion and Mass Encryption Dataset

This hunt covers the endgame of an intrusion: a simulated Sysmon/Security dataset (ransomware_vssadmin_massencrypt_2022-03-15T023000.json) capturing T1490: Inhibit System Recovery and T1486: Data Encrypted for Impact, where an adversary who has already achieved domain-admin-level access deletes Volume Shadow Copies and backup catalogs before mass-encrypting files across the environment - the final, loudest stage of a ransomware operation.

Step 1: Hypothesis Formation

Hypothesis: Adversary executes vssadmin.exe delete shadows /all /quiet and wbadmin.exe delete catalog -quiet (or PowerShell equivalents) from a privileged context on multiple hosts within minutes of each other, immediately followed by a burst of file writes/renames across user and share directories with a new, consistent extension appended (e.g., .locked), plus a ransom note dropped in each touched directory. Indicators:

Security 4688/Sysmon 1: vssadmin.exe delete shadows, wbadmin.exe delete catalog, bcdedit.exe /set {default} recoveryenabled no.
Sysmon Event 11: Mass file creation/rename with a new extension, at a rate far above normal user activity (hundreds/thousands per minute).
Sysmon Event 11: README_RESTORE.txt/ransom note files created in every touched directory.
Cross-host timing: same commands executed near-simultaneously on multiple servers - indicates automated deployment (e.g., via GPO, PsExec, or a C2 "encrypt all" task), not a single manual actor.

Null Hypothesis: Legitimate backup/disk-maintenance operation (e.g., an admin clearing old shadow copies to free disk space). Invalidate via the co-occurrence with mass file renaming and ransom-note drops - no legitimate maintenance activity does both together.

Rationale: This is deliberately the "smoking gun" hunt in the series - it demonstrates why proactive hunting on the earlier-stage techniques (credential theft, lateral movement, discovery) matters: by the time this fires, recovery options have already been destroyed.

Step 2: Data Sources and Scope

Sources: Security (4688 for command execution); Sysmon (1 proc create, 11 file create/rename); System (7036 for stopped backup-related services).
Scope: ~2022-03-15T02:30:00-02:34:00 UTC; Hosts: FILESERVER01, FILESERVER02, SQL01, DC01 (near-simultaneous); Account: DA_svc (compromised domain admin).
SIEM Queries (Splunk/ELK):
Shadow deletion: index=security EventID=4688 CommandLine="vssadmin delete shadows" OR CommandLine="wbadmin delete catalog"
Mass write burst: index=sysmon EventID=11 | bucket _time span=1m | stats count by Hostname, _time | where count > 200
Ransom note: index=sysmon EventID=11 TargetFilename="README" OR TargetFilename="_RESTORE" OR TargetFilename="HOW_TO"

Step 3: Key Findings

Parsed events (10 shown) confirm coordinated shadow-copy destruction across four hosts within 90 seconds, followed immediately by mass encryption activity.

Timestamp (UTC)	Host	Event ID	Key Details	IOC/Why Suspicious?
2022-03-15 02:30:01	FILESERVER01	4688	CommandLine=`vssadmin.exe delete shadows /all /quiet`; SubjectUserName=DA_svc.	Cover IOC: Recovery-inhibition begins - this alone should be a P1 alert regardless of what follows.
2022-03-15 02:30:03	FILESERVER01	4688	CommandLine=`wbadmin.exe delete catalog -quiet`.	Removes Windows Backup catalog - second recovery layer destroyed.
2022-03-15 02:30:05	FILESERVER01	4688	CommandLine=`bcdedit /set {default} recoveryenabled no` and `bcdedit /set {default} bootstatuspolicy ignoreallfailures`.	Disables Windows recovery environment - belt-and-suspenders against restoration.
2022-03-15 02:30:40	FILESERVER02	4688	Same three commands, same account, 39 seconds later.	Coordination IOC: Near-simultaneous execution across a second host - automated deployment, not one operator typing manually on each box.
2022-03-15 02:31:10	SQL01	4688	Same command set.	Third host in the same 90-second window - confirms scripted/GPO-pushed execution.
2022-03-15 02:32:00	FILESERVER01	11 (File Create) x340/min	Mass rename: `Q3_Report.xlsx` → `Q3_Report.xlsx.locked`; pattern repeats across \\FILESERVER01\Finance\ and \\FILESERVER01\HR\.	Core IOC: Sustained 300+ file operations per minute - no legitimate user or backup job produces this volume.
2022-03-15 02:32:05	FILESERVER01	11 (File Create)	`\\FILESERVER01\Finance\README_RESTORE.txt` created in every touched directory.	Ransom note IOC: Confirms ransomware, not corruption or bulk legitimate re-encryption (e.g., BitLocker rollout).
2022-03-15 02:33:15	FILESERVER02	11 (File Create) x290/min	Same rename pattern on FILESERVER02 shares.	Confirms multi-host simultaneous encryption - enterprise-wide event, not isolated.
2022-03-15 02:34:00	DC01	7036 (Service Stop)	Service `Volume Shadow Copy` and `Windows Backup` stopped.	Services proactively disabled to prevent future shadow copies during the encryption window.

Validation:

Timeline: Shadow deletion → recovery disable → mass encryption, replicated across four hosts within a 4-minute window - consistent with a centrally-triggered ransomware deployment (e.g., via a compromised GPO or RMM tool).
False Positives: None plausible - the combination of recovery-destruction commands, sustained mass file renaming, and ransom-note drops has no benign explanation.
Correlation: Single compromised account (DA_svc) used across all four hosts; timing gaps (39s, 30s) suggest scripted remote execution rather than manual RDP hopping.

Step 4: Recommendations & Next Steps

Immediate Response: This is a declare-the-incident moment - isolate all affected hosts from the network immediately (do not power off, to preserve memory for forensics); activate the incident response/business continuity plan; identify and revoke DA_svc; check for offline/immutable backups untouched by the shadow-copy deletion.
Detection: Sigma: title: Ransomware Precursor - Shadow Copy Deletion → selection: EventID=4688 CommandLine contains 'vssadmin' AND contains 'delete shadows' - this should already be a standing, tested, P1 alert in any mature SOC, not a hunt finding.
Pro Tip: The real value of this hunt is retrospective - walk backward from this event through the earlier hunts in this series (Kerberoasting, DCSync, PtH, WMI lateral movement) to reconstruct the full kill chain and close every gap that allowed the actor to reach domain-admin-equivalent access in the first place.

Hypothesis confirmed - coordinated, multi-host ransomware deployment with recovery destruction and mass encryption! This should never be the first detection point - treat every earlier-stage hunt in this series as a chance to stop the chain before this page is ever written.