SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-ransomware-precursor-behavior
0
Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and backup deletion, recovery disabling, security-tool tampering, and mass file modification — so the attack can be stopped before payload detonation. Activates for requests to hunt ransomware precursors, detect shadow-copy deletion, or find pre-encryption recovery sabotage.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting Ransomware Precursor Behavior ## When to Use - You have endpoint process/command telemetry and want to catch the steps ransomware takes *before* encrypting — deleting shadow copies, disabling recovery, killing security tools, and stopping backup/database services. - You want early warning to intervene before payload detonation. **Do not use** this as a substitute for blocking the encryption itself — it is an early-warning hunt for the preparation phase, not a recovery procedure. ## Prerequisites - Process-creation telemetry (with command line) and optionally service/file telemetry. ## Workflow ### Step 1: Hunt recovery-inhibition commands ```bash python scripts/analyst.py hunt events.csv ``` Flags `vssadmin delete shadows`, `wmic shadowcopy delete`, `wbadmin delete catalog`, `bcdedit /set recoveryenabled no` / `bootstatuspolicy ignoreallfailures`, and `wevtutil cl`. ### Step 2: Detect defense and service tampering Surface stopping/killing of AV/EDR and backup/DB services (`net stop`, `taskkill`, `sc stop`) targeting `veeam`, `sql`, `backup`, `sophos`, `defender`, etc. ### Step 3: Correlate and prioritize A host showing recovery-inhibition + service-stop in a short window is a high-priority pre-encryption signal — escalate immediately. ### Step 4: Operationalize Write a high-severity detection for shadow-copy deletion and recovery disabling. ## Validation - Recovery-inhibition commands are detected with their specific syntax. - Security/backup service tampering is identified by target service names. - Findings map to ATT&CK T1490 / T1489 (and precede T1486). ## Pitfalls - Admins occasionally delete shadow copies legitimately — corroborate with co-occurring tampering. - LOLBin variants (`wmic`, PowerShell `Get-WmiObject Win32_ShadowCopy | Remove`) evading `vssadmin`-only rules. - Fast attacks where precursor and encryption are near-simultaneous — alert must be real-time. ## References - See [`references/api-reference.md`](references/api-reference.md) for the hunter. - ATT&CK T1490 and T1486 (linked in frontmatter).