Threat Hunting with MITRE ATT&CK: Spotting Pre-Ransomware Activity
Proactive detection techniques to catch threat actors during the reconnaissance and lateral movement phases before encryption strikes.
Shifting from Reactive Alerting to Proactive Hunting
Waiting for automated antivirus alerts means responding only after malware has executed. Threat hunting systematically searches environment telemetry for subtle adversarial behaviors mapped to the MITRE ATT&CK framework.
High-Probability Pre-Ransomware Techniques to Hunt
Reconnaissance: Unusual `adfind.exe`, `nltest /dclist`, or `net group "domain admins" /domain` executions.
Credential Dumping: Suspicious process handles accessing `lsass.exe`.
Defense Evasion: Execution of `vssadmin.exe delete shadows` or disabling Windows Defender via PowerShell.
Developing Continuous KQL and Sigma Rules
Convert successful hunting hypotheses into permanent automated detection rules within your SIEM/EDR platform to continuously catch future attempts.
Related Articles & Advisories
Ransomware Containment Playbook: The First 60 Minutes of an Attack
The precise tactical steps IT and security teams must execute during the critical first hour of active encryption to stop lateral spread.
Building Immutable and Air-Gapped Backups to Defeat Modern Ransomware
Architecting WORM storage, isolated management planes, and zero-trust recovery vaults that attackers cannot delete or encrypt.
Digital Forensic Readiness: Ensuring Logs Are Retained, Centralized & Tamper-Proof
How to ensure your enterprise collects the forensic telemetry needed to satisfy law enforcement, cyber insurers, and regulatory auditors.