Detect the precursors, and test the restore

short · 60 min · Objective 3.3

Task

Produce the actions that precede encryption -- shadow copy deletion, defence tampering, mass file reads, bulk outbound transfer -- and build a detection for each. Then find out whether your backups would actually have survived. Nothing in this lab encrypts anything.

Steps

  1. Shadow copy deletion. On the Windows VM, run vssadmin delete shadows /all /quiet. This is destructive to restore points on a disposable VM and is the single highest-value ransomware precursor signal, because almost nothing legitimate does it.
  2. Defence tampering. Stop and disable the endpoint agent and the Windows security service. Record what, if anything, noticed.
  3. Mass file read. Generate a few thousand small files, then read every one of them with a single account in a short window.
  4. Bulk outbound. Archive that directory and transfer it to the Linux VM in one go.
  5. Write a detection for each of the four, and test each by re-running the action from a reverted snapshot.
  6. The backup question. Answer, with evidence rather than opinion: from the Windows VM with administrative rights, can you reach and delete the collector's backup? If yes, you have just demonstrated why the answer determines the outcome of a real incident.
  7. Perform a restore from that backup and time it.

Verify

powershell -c "(Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} -MaxEvents 500 | Where-Object {$_.Message -match 'vssadmin'}).Count"
powershell -c "(Get-WinEvent -FilterHashtable @{LogName='System'} -MaxEvents 500 | Where-Object {$_.Message -match 'service was stopped'}).Count"
find /tmp/bulk -type f | wc -l
tar -tzf /tmp/collector-backup.tar.gz | wc -l

The first two must be non-zero: both precursors left evidence, and if either is zero you have found a telemetry gap that would cost you the early warning. The file count and the backup listing confirm the mass-read set and that the backup is readable rather than merely present.

Notes

The first detection is the one to keep. Shadow copy deletion is close to a perfect signal -- high value, almost no legitimate use, and it fires before any file is encrypted, which is the only window in which the incident can still be won.

If step 6 showed the backup was reachable, write it up as a finding today. That single property decides more ransomware outcomes than any detection in this lab.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.