Detecting LockBit: Documented TTPs and Behavioural Artifacts

LockBit was one of the most prolific ransomware-as-a-service operations, with successive versions often called LockBit 2.0 and LockBit 3.0 (LockBit Black). Law-enforcement action in 2024 disrupted the group’s infrastructure, and its leaked builder has fed derivative encryptors. Because affiliates choose their own tools, we detect the documented behaviours across the intrusion, and we do not rely on hashes or infrastructure that change per affiliate.

Signals at a Glance

What Public Reporting Describes

Government and vendor reporting on LockBit describes affiliates gaining access through exposed remote services, phishing and valid accounts, then using commodity tooling such as Mimikatz, Cobalt Strike and PsExec, with custom exfiltration tooling widely known as StealBit alongside tools such as rclone. LockBit 3.0 builds are described as modular and, in many cases, requiring a password argument at execution to run or to unpack, which complicates sandboxing. Spread through Group Policy and scheduled tasks is documented for earlier versions. The detections that follow are keyed on those behaviours:

• Pre-encryption chain: shadow copy deletion, service and process kills, and log clearing on one host within minutes of each other.
• Domain-wide deployment: a new GPO or immediate scheduled task created on a domain controller that points to an executable in a share or temp path.
• Execution parameters: a binary run with an unusual long argument, a password-style parameter, from a user-writable or share path.
• Post-encryption artefacts: a new extension association and icon registered for the encrypted extension, a wallpaper change and notes dropped in many folders.

// KQL - GPO or scheduled-task deployment from a domain controller
// followed by a pre-encryption chain on member hosts
let gpoDeploy = SecurityEvent
    | where EventID in (5136, 4698, 4699)   // GPO attribute change, task created
    | where Computer has "DC" or Computer in (DomainControllerList)
    | project DeployTime=TimeGenerated, DC=Computer, Account=SubjectUserName, EventID;
let preEnc = DeviceProcessEvents
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled")
    | project PreTime=Timestamp, DeviceName, Cmd=ProcessCommandLine;
gpoDeploy
| join kind=inner (preEnc) on $left.Account == $right.DeviceName   // replace with your account-to-host mapping
| where PreTime between (DeployTime .. DeployTime + 2h)
// tune/validate: DomainControllerList and the join key are placeholders for your environment.

Hunting Beyond the Encryptor

• Because the builder leaked, treat family attribution as secondary. Detect the behaviours (spread, kills, deletion, encryption) and attribute later from the note and infrastructure.
• Monitor for new Group Policy objects and scheduled tasks created on domain controllers outside change windows, and alert on write access to SYSVOL by non-administrative accounts.
• Hunt for the exfiltration tooling stage on file servers and domain controllers, since that precedes encryption by days.
• Retain the encryptor sample and any command-line password argument for the response team; it is often needed for analysis.