Ransomware Early-Warning Detection

By the time files are encrypting, you have already lost the window to respond well. Modern ransomware is the last step of a longer intrusion, and it announces itself with loud precursors — the attacker deletes volume shadow copies, disables recovery, tampers with backups, and spikes file activity. The single best early-warning signal is shadow- copy deletion: it happens just before encryption and has almost no legitimate use at scale. This guide ships that detection and the recovery-focused hardening behind it.

Ransomware maps to MITRE ATT&CK T1486 — Data Encrypted for Impact, and its recovery-inhibition step to T1490 — Inhibit System Recovery. It rides on the lateral movement, credential theft, and BYOVD covered across the Windows detection cluster.

Why detect ransomware before encryption?

Encryption is fast and irreversible; detecting it as it happens leaves you watching the damage. But ransomware operators spend days or weeks inside a network first — gaining access, stealing credentials, moving laterally, exfiltrating data for double extortion, and disabling defenses and backups — before they push the encryptor. Every one of those stages is detectable, and each gives far more time to contain the intrusion than the encryption itself.

The most reliable single early-warning signal sits right before encryption: the attacker destroys the local recovery options so you cannot simply restore. That action is loud, rare, and almost always malicious at scale.

What are the ransomware precursor signals?

The earlier in this list you detect, the more of the intrusion you can stop. Shadow-copy deletion is the highest-value single rule; the file-change spike is the last chance before loss.

How to detect ransomware early

The core rule flags the recovery-inhibition commands, via process-creation telemetry.

title: Volume Shadow Copy Deletion or Recovery Disable
id: 9d2f1a83-darkpwn-illustrative
status: stable
logsource:
  product: windows
  category: process_creation
detection:
  vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all: ['delete', 'shadows']
  wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains: ['recoveryenabled no', 'bootstatuspolicy ignoreallfailures']
  condition: vssadmin or wbadmin or bcdedit
falsepositives:
  - Rare legitimate backup maintenance (allowlist the specific admin host/account)
level: high

How to test your ransomware detection

In an isolated VM you own:

1. Run a benign vssadmin delete shadows in a lab and confirm the rule fires; allowlist the legitimate backup-admin path.
2. Simulate a mass-file-change spike (a benign script renaming test files) and confirm the rate detection triggers.
3. Deploy canary files and confirm access to them alerts.
4. Confirm normal backup maintenance, once allowlisted, stays quiet.

How to defend against ransomware

• Detect and contain the earlier stages — credential theft, lateral movement, exfiltration — for the biggest response window.
• Automate host isolation on the shadow-copy-deletion alert.
• Keep EDR tamper protection on and monitor for BYOVD.

Common ransomware-detection mistakes

• Waiting for encryption. Detect the precursors for a real window.
• No shadow-copy-deletion rule. The highest-value early signal goes uncollected.
• Online-only backups. The attacker deletes what they can reach.
• No isolation response. Detection without containment just watches.

Ransomware early-warning detection checklist

1. Alert on shadow-copy deletion and recovery-disable commands (vssadmin/wbadmin/bcdedit).
2. Detect abnormal file-modification/rename rates and odd extensions per host.
3. Deploy canary/honey files and alert on access.
4. Detect the precursors: credential theft, lateral movement, exfiltration, EDR tampering.
5. Automate host isolation on the recovery-inhibition alert.
6. Maintain tested 3-2-1 backups with an offline/immutable copy.
7. Segment the network and protect backup infrastructure as Tier 0.
8. Rehearse restoration; keep EDR tamper protection on.

The takeaway

Ransomware early-warning detection means catching the precursors — shadow-copy deletion first, then mass file change — instead of the encryption, backed by isolation response and recoverable offline backups. Detect the credential theft and lateral movement earlier for even more time. Continue with lateral movement detection and BYOVD detection, or browse the full Detection Engineering pillar.