agentsclimarketplace

Hunting ransomware precursor behavior

Skill meltedinhex/analyst-ai-pack/skills/hunting-ransomware-precursor-behavior

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-ransomware-precursor-behavior

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and backup deletion, recovery disabling, security-tool tampering, and mass file modification — so the attack can be stopped before payload detonation. Activates for requests to hunt ransomware precursors, detect shadow-copy deletion, or find pre-encryption recovery sabotage.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.0 KB, 485 tokens by cl100k_base, as published. Nobody here has run it

Hunting Ransomware Precursor Behavior

When to Use

  • You have endpoint process/command telemetry and want to catch the steps ransomware takes before encrypting — deleting shadow copies, disabling recovery, killing security tools, and stopping backup/database services.
  • You want early warning to intervene before payload detonation.

Do not use this as a substitute for blocking the encryption itself — it is an early-warning hunt for the preparation phase, not a recovery procedure.

Prerequisites

  • Process-creation telemetry (with command line) and optionally service/file telemetry.

Workflow

Step 1: Hunt recovery-inhibition commands

python scripts/analyst.py hunt events.csv

Flags vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete catalog, bcdedit /set recoveryenabled no / bootstatuspolicy ignoreallfailures, and wevtutil cl.

Step 2: Detect defense and service tampering

Surface stopping/killing of AV/EDR and backup/DB services (net stop, taskkill, sc stop) targeting veeam, sql, backup, sophos, defender, etc.

Step 3: Correlate and prioritize

A host showing recovery-inhibition + service-stop in a short window is a high-priority pre-encryption signal — escalate immediately.

Step 4: Operationalize

Write a high-severity detection for shadow-copy deletion and recovery disabling.

Validation

  • Recovery-inhibition commands are detected with their specific syntax.
  • Security/backup service tampering is identified by target service names.
  • Findings map to ATT&CK T1490 / T1489 (and precede T1486).

Pitfalls

  • Admins occasionally delete shadow copies legitimately — corroborate with co-occurring tampering.
  • LOLBin variants (wmic, PowerShell Get-WmiObject Win32_ShadowCopy | Remove) evading vssadmin-only rules.
  • Fast attacks where precursor and encryption are near-simultaneous — alert must be real-time.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.