Detection Pack Cross-Platform

Ransomware Detection Pack

64 detection rules targeting the full ransomware kill chain — from initial access and lateral movement through backup deletion and encryption initiation. Stop ransomware before files are lost, not after.

Activate this pack Impact tactic coverage

Pack summary

Detection rules: 64
Critical severity: 24
Kill chain coverage: All stages
ATT&CK techniques: 22

What's included

64 rules across the full ransomware kill chain — from precursors to encryption impact.

Backup & Recovery Destruction 16 rules

Shadow copy deletion, backup vault tampering, S3 object mass deletion, snapshot removal.

Precursor & Lateral Movement 18 rules

SMB spray, RDP brute force, DCSync, scheduled task persistence, credential dumping.

Initial Access 12 rules

MFA bypass, phishing indicators, exploit of public-facing applications, C2 IOC matches.

Encryption Phase 10 rules

Mass file rename, SharePoint/OneDrive bulk modification, ransomware note creation.

Defense Evasion 8 rules

Defender disabling, backup agent uninstallation, log clearing, AMSI bypass.

Detection rules (20 of 64 shown)

Showing 20 representative rules. All 64 rules activate with one click.

Rule name	Description	Severity	ATT&CK	Source
Endpoint Detection — Mass File Rename with Encryption Extension	Large number of files renamed with ransomware extension (.locked, .encrypted, .ryk, etc.) in minutes.	Critical	T1486	EDR / Endpoint
AWS S3 — Mass Object Deletion (No Versioning)	Bulk S3 object deletion from a bucket without versioning enabled — irreversible data destruction.	Critical	T1485	CloudTrail
Azure Backup Vault Soft Delete Disabled	Azure Backup vault soft delete disabled — enables permanent backup deletion.	Critical	T1490	Activity Log
GCP — Snapshot Deletion Across Multiple Projects	Disk snapshots deleted across multiple GCP projects in rapid succession.	Critical	T1490	GCP Audit Logs
Okta / Entra ID — MFA Bypass Followed by Mass File Access	MFA bypass detected on an account that immediately accesses high volume of files.	Critical	T1078	Identity + SaaS Logs
AWS Backup Vault Access Policy Modified to Allow Deletion	Backup vault resource policy modified to grant DeleteBackupVault permissions.	Critical	T1490	CloudTrail
Active Directory — KRBTGT Hash Reset (DCSync Precursor)	KRBTGT account password reset or DCSync operation detected — Golden Ticket attack precursor.	Critical	T1003.006	AD / Defender for Identity
Lateral Movement — SMB Spray to Multiple Hosts	High-volume SMB connection attempts across many internal hosts — ransomware propagation.	Critical	T1021.002	Network / EDR
Volume Shadow Copy Deletion	vssadmin or wmic command used to delete Volume Shadow Copies — backup destruction.	Critical	T1490	EDR / Windows Event
Windows Defender Tampered — Real-Time Protection Disabled	Windows Defender real-time protection disabled via registry or PowerShell.	Critical	T1562.001	EDR / Event Log
Ransomware IOC — Known C2 Domain or IP in DNS / Network Log	Connection to domain or IP associated with active ransomware group infrastructure.	Critical	T1071.004	DNS / Network
SharePoint / OneDrive — Mass File Encryption Pattern	Large number of files modified and replaced in SharePoint or OneDrive within minutes.	Critical	T1486	M365 Audit
Backup Agent Uninstalled or Service Stopped	Backup agent (Veeam, Commvault, Cohesity) service stopped or agent uninstalled.	High	T1490	EDR / Event Log
Remote Desktop — Successful Login After Multiple Failures (Brute Force)	RDP brute force followed by successful login — common ransomware initial access pattern.	High	T1110	Windows Event / Network
PowerShell — Download Cradle Executing Encoded Command	PowerShell executes encoded command that downloads and executes a remote payload.	High	T1059.001	EDR / PowerShell Logs
Network Scan — Internal Reconnaissance Across /16 Subnet	Single host scans more than 1000 internal IPs — pre-encryption network mapping.	High	T1046	Network / EDR
Ransomware Note File Created (README.txt, RESTORE_FILES.txt)	File matching known ransomware note naming patterns created in multiple directories.	Critical	T1486	EDR / File Monitoring
AWS — EC2 Instance Terminate All in Region	All EC2 instances terminated in a region outside of maintenance schedules.	Critical	T1485	CloudTrail
Domain Admin Account Created Outside Provisioning	Domain Admin or Tier-0 account created outside of IT provisioning workflow.	High	T1136.002	AD Audit / Entra ID
Scheduled Task Created to Execute Payload at Boot	Scheduled task or registry run key created to execute a payload on system startup.	High	T1053.005	EDR / Windows Event

Prerequisites

Endpoint Detection and Response (CrowdStrike, SentinelOne, Microsoft Defender) connected for endpoint-layer rules
Cloud audit logs (AWS CloudTrail, Azure Activity Log, GCP Audit) enabled for cloud-native ransomware detection
Identity provider (Okta or Entra ID) connected for identity-layer initial access detection
Threat intelligence integration (Recorded Future or MISP) for ransomware C2 IOC matching

Ransomware Detection Pack: frequently asked questions

What makes this a ransomware-specific detection pack versus general endpoint security?

The ransomware detection pack combines pre-encryption precursor detection (backup deletion, shadow copy removal, lateral movement) with encryption-phase detection (mass file rename, M365 bulk modification) and cloud-layer detection (S3 mass deletion, Azure backup vault tampering). Most endpoint security products detect only the encryption phase. ManySignal's cross-layer correlation detects the attack chain earlier.

Can ManySignal detect ransomware before files are encrypted?

Yes — this is the primary value of the ransomware pack. The most actionable detections are precursor events: backup vault soft-delete being disabled (T1490), Volume Shadow Copy deletion, mass lateral movement via SMB, and C2 domain contact. These events occur minutes to hours before encryption begins. Detecting them enables intervention before data is lost.

Does this pack cover cloud-native ransomware (targeting S3 and Azure Storage)?

Yes. Cloud-native ransomware attacks encrypt or delete cloud storage objects rather than local files. The pack includes specific rules for S3 mass object deletion, Azure Blob mass overwrite, and GCP snapshot deletion — all patterns consistent with cloud ransomware (such as the Scattered Spider attacks on cloud infrastructure).

How does ManySignal correlate ransomware signals across identity and endpoint?

A ransomware attack typically starts with identity compromise (MFA bypass, brute force success) before moving to endpoint execution and backup deletion. ManySignal's investigation timeline links the initial identity event with subsequent endpoint and cloud events into a single correlated incident — giving responders full attack chain visibility in one view.

What automated response actions can ManySignal take on ransomware detection?

ManySignal can trigger automated response actions via integrated platforms: suspend Okta or Entra ID user sessions, isolate endpoints via CrowdStrike or SentinelOne, block network communications via Cloudflare, and create high-priority JIRA or ServiceNow incidents. Automated containment before human review is configurable per rule severity.

Detect ransomware precursors before encryption begins

64 detection rules across endpoint, identity, cloud, and SaaS — correlating the full ransomware kill chain from initial access through backup destruction.

Book a demo Explore the platform