Hunting ransomware precursor behavior
Skill meltedinhex/analyst-ai-pack/skills/hunting-ransomware-precursor-behavior
An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-ransomware-precursor-behaviorAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and backup deletion, recovery disabling, security-tool tampering, and mass file modification — so the attack can be stopped before payload detonation. Activates for requests to hunt ransomware precursors, detect shadow-copy deletion, or find pre-encryption recovery sabotage.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.0 KB, 485 tokens by cl100k_base, as published. Nobody here has run it
Hunting Ransomware Precursor Behavior
When to Use
- You have endpoint process/command telemetry and want to catch the steps ransomware takes before encrypting — deleting shadow copies, disabling recovery, killing security tools, and stopping backup/database services.
- You want early warning to intervene before payload detonation.
Do not use this as a substitute for blocking the encryption itself — it is an early-warning hunt for the preparation phase, not a recovery procedure.
Prerequisites
- Process-creation telemetry (with command line) and optionally service/file telemetry.
Workflow
Step 1: Hunt recovery-inhibition commands
python scripts/analyst.py hunt events.csv
Flags vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete catalog,
bcdedit /set recoveryenabled no / bootstatuspolicy ignoreallfailures, and wevtutil cl.
Step 2: Detect defense and service tampering
Surface stopping/killing of AV/EDR and backup/DB services (net stop, taskkill,
sc stop) targeting veeam, sql, backup, sophos, defender, etc.
Step 3: Correlate and prioritize
A host showing recovery-inhibition + service-stop in a short window is a high-priority pre-encryption signal — escalate immediately.
Step 4: Operationalize
Write a high-severity detection for shadow-copy deletion and recovery disabling.
Validation
- Recovery-inhibition commands are detected with their specific syntax.
- Security/backup service tampering is identified by target service names.
- Findings map to ATT&CK T1490 / T1489 (and precede T1486).
Pitfalls
- Admins occasionally delete shadow copies legitimately — corroborate with co-occurring tampering.
- LOLBin variants (
wmic, PowerShellGet-WmiObject Win32_ShadowCopy | Remove) evadingvssadmin-only rules. - Fast attacks where precursor and encryption are near-simultaneous — alert must be real-time.
References
- See
references/api-reference.mdfor the hunter. - ATT&CK T1490 and T1486 (linked in frontmatter).