Detection and Early Indicators

Ransomware operators spend hours or days inside a network before encrypting. This dwell time is your detection window. Catching the intrusion during reconnaissance or lateral movement lets you contain it before any files are locked.

Detection focuses on behavior, not just signatures, because attackers abuse legitimate tools to stay quiet.

Early indicators often appear at the perimeter and identity layer:

• Successful logins from unusual geographies or impossible travel
• A spike in failed RDP or VPN attempts (brute force)
• New external connections from internet-facing servers
• A user reporting a phishing email after clicking

Correlating identity logs with network data surfaces these before the attacker digs in.

Once inside, attackers map the environment. This discovery activity is noisy if you watch for it.

Spreading between hosts leaves distinctive traces:

• Use of remote execution tools across many machines in a short window
• Privileged accounts logging into hosts they never normally touch
• New service or scheduled task creation on multiple endpoints
• Unusual SMB or admin-share access patterns

A single account suddenly authenticating to dozens of machines is a strong signal to investigate immediately.

Before encrypting, operators try to blind your defenses. Attempts to disable security tooling are high-fidelity alerts.

• Stopping or uninstalling EDR or antivirus services
• Disabling logging or clearing event logs
• Modifying security policy or adding exclusions

Enable tamper protection and alert on any attempt to disable defenses; legitimate admins rarely do this in bulk.

Destroying recovery options is a near-universal pre-encryption step and an excellent late-stage tripwire.

Double-extortion crews steal data before encrypting. Watch egress for staging and transfer.

• Large outbound transfers to unfamiliar cloud storage or IPs
• Archiving tools compressing large datasets unexpectedly
• New use of file-transfer utilities from servers
• Off-hours spikes in outbound bandwidth

Egress monitoring and DLP can catch the theft phase even if earlier stages were missed.

Deception provides cheap, high-signal detection. Plant decoys that no legitimate user should ever touch.

• Canary files in directories that alert on access or modification
• Honeytoken credentials that fire an alarm if ever used
• Fake high-value shares monitored for any interaction

When ransomware mass-encrypts, it hits the canaries early, giving you an immediate, low-noise alert.

The encryption phase itself has a recognizable footprint that EDR and file-monitoring can catch in seconds.

• A process rapidly reading and rewriting many files
• Mass file renames or new uniform extensions appearing
• Sudden surge in file entropy (encrypted data looks random)
• Ransom note files appearing across directories

Automated response can isolate the host the moment this pattern starts, limiting how many files are lost.

Indicators only help if they are collected and correlated. Centralize telemetry so isolated signals become a clear picture.

• Ship endpoint, identity, network, and backup logs to a SIEM
• Write detections for the behaviors above and tune out noise
• Map alerts to attack stages (MITRE ATT&CK) for context
• Ensure logs are tamper-resistant so attackers cannot erase their tracks

Detection is only valuable if it triggers fast response. Prepare in advance:

• Define which alerts warrant automatic host isolation
• Set clear escalation paths and on-call coverage
• Rehearse so responders act in minutes, not hours

The earlier in the chain you detect, the more you contain. The next lesson covers what to do once an attack is confirmed.

Identify the highest-value early signal.

You learned to spot an attack during its dwell time.

• Detection targets behavior: unusual logins, AD recon, lateral movement
• Defense tampering and shadow copy deletion are high-fidelity tripwires
• Watch egress for exfiltration; plant canary files and honeytokens
• Behavioral encryption detection (entropy, mass renames) enables auto-isolation
• Centralize in a SIEM with tamper-resistant logs and a fast alert-to-action path

Next: responding to and recovering from a confirmed attack.