detecting-ransomware-precursors-in-network

name	detecting-ransomware-precursors-in-network
description	Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
domain	cybersecurity
subdomain	ransomware-defense
tags	["ransomware","detection","network-security","incident-response","defense"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"]
mitre_attack	["T1078","T1190","T1059","T1003","T1110"]
mitre_f3	{"version":"1.1","tactics":["initial-access","positioning","monetization"],"techniques":[{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1650","name":"Acquire Access","tactic":"resource-development","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"}]}

Detecting Ransomware Precursors in Network Traffic

When to Use

• Building detection rules for pre-ransomware network activity (the average time from Cobalt Strike deployment to encryption is 17 minutes)
• Monitoring for initial access broker (IAB) indicators that precede ransomware deployment
• Creating SIEM correlation rules that chain multiple precursor events into high-confidence alerts
• Tuning network detection systems to distinguish ransomware staging from normal administrative activity
• Investigating suspicious network patterns that may indicate ransomware operators have established a foothold

Do not use for post-encryption response (see recovering-from-ransomware-attack). This skill focuses on the pre-encryption detection window where containment can prevent data loss.

Prerequisites

• Network detection platform (Zeek/Bro, Suricata, or Arkime/Moloch) deployed on network TAP or SPAN ports
• SIEM platform (Splunk, Elastic Security, Microsoft Sentinel, or QRadar) ingesting network logs
• Threat intelligence feeds covering ransomware IOCs (CISA, abuse.ch, OTX, MISP)
• Network flow data (NetFlow/IPFIX) from core routers and firewalls
• DNS query logging from internal resolvers
• Full packet capture capability for incident investigation

Workflow

Step 1: Identify Ransomware Kill Chain Phases in Network Traffic

Map network-observable indicators to each pre-encryption phase:

Kill Chain Phase	Network Indicators	Detection Source
Initial Access	RDP brute force, VPN credential stuffing, phishing callback	Firewall logs, IDS, proxy logs
C2 Establishment	Cobalt Strike beacons (HTTPS/DNS), Sliver/Brute Ratel callbacks	Zeek SSL/HTTP logs, DNS logs
Credential Harvesting	NTLM relay, Kerberoasting, DCSync traffic	Zeek Kerberos/NTLM logs, DC logs
Reconnaissance	Internal port scanning, AD enumeration (LDAP/SMB)	Zeek conn.log, flow data
Lateral Movement	PsExec/WMI/WinRM traffic, RDP pivoting, SMB file copies	Zeek SMB/DCE-RPC logs
Staging	Data aggregation, archive creation, cloud upload prep	Proxy logs, DNS logs, DLP

Step 2: Deploy Network Detection Rules

Suricata rules for common ransomware precursors: