Threat Hunt: Ransomware Intrusion Investigation

Reconstructing a multi-stage ransomware attack using Microsoft Defender and KQL

Overview

This threat hunt investigated suspicious activity across multiple hosts using Microsoft Defender for Endpoint telemetry. The goal was to reconstruct the attack lifecycle, identify attacker techniques, and determine the scope of compromise.

The investigation revealed a multi-stage attack involving reconnaissance, credential discovery, command-and-control activity, data staging, and ransomware deployment.

Executive Summary

This investigation identified a multi-stage ransomware intrusion affecting two hosts (AS-PC2 and AS-SRV). The attacker leveraged LOLBins for tool delivery, performed network reconnaissance and credential discovery, established remote access via AnyDesk, and staged data prior to ransomware deployment.

Key findings:

• Ransomware payload: updater.exe
• SHA256: e609d070ee9f76934d73353be4ef7ff34b3ecc3a2d1e5d052140ed4cb9e4752b
• Initial encryption timestamp: 22:18:33 UTC
• Shadow copies deleted to prevent recovery
• Evidence cleanup performed via script-based deletion

The attack demonstrates common ransomware tradecraft aligned with MITRE ATT&CK techniques.

---

Deliverables 📄

👉 An Executive Summary Report can be downloaded via my cybersecurity blog, Happy Bytes

• Viewable on GitHub: Ransomware Threat Hunting Summary Report (PDF)

---

⚠️ Educational / Defensive Security Disclaimer

This repository contains cybersecurity learning exercises and defensive security analysis. The materials document investigations, threat hunting, or incident response scenarios for educational and portfolio purposes.

No malware, exploits, or offensive tooling are distributed in this repository. Any IP addresses, indicators, or artifacts are included strictly for analysis and educational demonstration.

---

Environment

Telemetry Source

Microsoft Defender for Endpoint Advanced Hunting (KQL)

Tables Used

• DeviceProcessEvents
• DeviceFileEvents
• DeviceNetworkEvents
• DeviceEvents

Systems Investigated

AS-PC2, AS-SRV

---

Key Findings

• Multi-stage intrusion observed across endpoints
• Use of LOLBins for initial payload delivery
• Network scanning using advanced_ip_scanner.exe
• Credential discovery via LSASS enumeration
• Persistence established using AnyDesk.exe
• Data staging activity detected prior to encryption
• Ransomware execution and cleanup observed

MITRE ATT&CK Mapping

Attack Phase	Technique
Initial Access	T1105 – Ingress Tool Transfer
Execution	T1059 – Command Execution
Discovery	T1046 – Network Service Discovery
Credential Access	T1003 – OS Credential Dumping
Command & Control	T1071 – Application Layer Protocol
Exfiltration Prep	T1560 – Archive Collected Data
Defense Evasion	T1562 – Disable Security Tools
Impact	T1486 – Data Encrypted for Impact

---

Attack Timeline

flowchart TD
A["22:10 Reconnaissance Begins<br>Network scanning observed"]
B["22:12 Tools Downloaded<br>LOLBins used"]
C["22:14 Security Controls Disabled"]
D["22:15 Credential Discovery<br>tasklist | findstr lsass"]
E["22:16 Data Staging"]
F["22:18:33 Ransom Note Dropped<br>Encryption Begins"]
G["22:19 Shadow Copies Deleted<br>vssadmin delete shadows"]
H["22:20 Ransomware Binary Deleted"]

A --> B --> C --> D --> E --> F --> G --> H

Loading

This timeline summarizes the sequence of attacker activity reconstructed from endpoint telemetry.

---

Attack Flow (MITRE ATT&CK)

---

Phase 1 - Reconnaissance

The attacker conducted network reconnaissance to identify accessible systems.

Tool observed

advanced_ip_scanner.exe

Detection Query

DeviceProcessEvents
| where ProcessCommandLine has "scanner"
| project Timestamp, DeviceName, FileName, ProcessCommandLine

---

Phase 2 - Credential Discovery

The attacker searched for the LSASS process to prepare for credential theft.

Command Used

tasklist | findstr lsass

Detection Query

DeviceProcessEvents
| where ProcessCommandLine has "tasklist"
| project Timestamp, DeviceName, ProcessCommandLine

---

Phase 3 - Command and Control

A remote access tool was deployed to maintain persistence. The presence of AnyDesk indicates the attacker established persistent remote access, enabling lateral movement and command execution.

Tool Observed

AnyDesk.exe

Detection Query

DeviceProcessEvents
| where FileName =~ "AnyDesk.exe"
| project Timestamp, DeviceName, ProcessCommandLine

---

Phase 4 - Data Staging

Files were compressed prior to potential data exfiltration. This activity is consistent with pre-encryption staging, where attackers prepare data for exfiltration or impact.

Detection Query

DeviceFileEvents
| where FileName matches regex @".*\.(zip|7z|rar)$"
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName

---

Phase 5 – Ransomware Deployment

The ransomware payload was deployed and executed on the compromised system, marking the transition from reconnaissance and staging to impact.

Malware Identified

updater.exe

SHA256

e609d070ee9f76934d73353be4ef7ff34b3ecc3a2d1e5d052140ed4cb9e4752b

Detection Query

DeviceProcessEvents
| where SHA256 == "e609d070ee9f76934d73353be4ef7ff34b3ecc3a2d1e5d052140ed4cb9e4752b"
| project Timestamp, DeviceName, FileName, ProcessCommandLine

---

Phase 6 - Backup Destruction

The attacker deleted backup copies to prevent recovery.

Command used

vssadmin delete shadows /all /quiet

Detection Query

DeviceProcessEvents
| where ProcessCommandLine has "vssadmin delete shadows"
| project Timestamp, DeviceName, ProcessCommandLine

---

Phase 7 - Encryption

Encryption began when the ransom note was created.

Ransom note time

22:18:33 UTC

Detection Query

DeviceFileEvents
| where FileName has_any ("readme","decrypt","recover","ransom")
| project Timestamp, DeviceName, FileName, FolderPath

---

Phase 8 - Evidence Cleanup

After execution, the attacker removed the ransomware binary.

Detection Query

DeviceProcessEvents
| where ProcessCommandLine has "updater.exe"
| where ProcessCommandLine has_any ("del","Remove-Item")
| project Timestamp, DeviceName, ProcessCommandLine

---

Scope of Compromise

Ransomware activity was confirmed on the following hosts:

• AS-PC2 (initial compromise / staging)
• AS-SRV (ransomware execution target)

---

Indicators of Compromise

Malware File: updater.exe

SHA256: e609d070ee9f76934d73353be4ef7ff34b3ecc3a2d1e5d052140ed4cb9e4752b

Shadow Copy Deletion Command:

vssadmin delete shadows /all /quiet

Credential Discovery Command:

tasklist | findstr lsass

---

Screenshots of Key Queries and Results

To support the investigation, screenshots of key Defender Advanced Hunting queries and results are included in this repository. These screenshots provide visual confirmation of the telemetry used to reconstruct the attack timeline.

Reconnaissance Query Result

---

Credential Discovery Query Result

---

Ransomware Execution Query Result

---

Shadow Copy Deletion Query Result

---

Ransom Note Creation Query Result

---

Detection Logic Summary

The following behaviors were used to detect malicious activity:

• Process execution with suspicious command-line arguments
• Known LOLBin abuse for tool delivery
• Creation of archive files in staging directories
• Shadow copy deletion commands
• Execution of known ransomware hash

These detections can be operationalized into SIEM or EDR alerts.

Detection Opportunities

Organizations can detect similar attacks by monitoring for:

Suspicious LOLBin Downloads

• certutil
• powershell Invoke-WebRequest
• bitsadmin

Credential Discovery Commands

tasklist | findstr lsass

Shadow Copy Deletion

vssadmin delete shadows | wmic shadowcopy delete

Suspicious Archive Creation

Files created in: C:\ProgramData | C:\Users\Public | C:\Windows\Temp

---

Analyst Notes

• The attacker followed a typical ransomware playbook:

  • Initial access via tool download
  • Internal reconnaissance
  • Credential discovery
  • Data staging
  • Impact via encryption

• Early detection opportunities existed at:

  • LOLBin usage
  • Network scanning activity
  • Credential discovery commands

• The use of cleanup techniques indicates attacker awareness of detection controls.

Limitations

• Analysis is based on available Defender telemetry
• Full network traffic visibility was not available
• Some attacker actions may not be fully captured

---

Conclusion

This threat hunt reconstructed a ransomware intrusion using Microsoft Defender telemetry. The attacker conducted reconnaissance, credential discovery, persistence establishment, and data staging before deploying ransomware.

Monitoring LOLBin downloads, credential discovery commands, shadow copy deletion, and archive creation can significantly improve ransomware detection and response times. This investigation demonstrates how endpoint telemetry and structured threat hunting can identify ransomware activity before impact.

---

License

This project is intended for educational and portfolio demonstration purposes.

---

Contact 📬

Feel free to connect on LinkedIn or review my other security projects.

Feedback and discussion are welcome. Thank you for reviewing this project. 🙏