When the operator is ready, they push the encryptor from a staging host to as many machines as possible using PsExec, remote WMI or scheduled tasks. Single lateral moves look like administration. A fan-out of the same remote execution to dozens of hosts does not, and it is the final early warning you get.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| One source creating the same service on many hosts | System 7045, EDR | T1569.002 |
| Admin share write of an executable from one source | 5145, Zeek SMB | T1570 |
| Remote WMI process creation across many targets | WMI-Activity, EDR | T1047 |
| Network logon type 3 fan-out from a non-admin workstation | 4624 | T1021.002 |
| PSEXESVC or renamed equivalent as a new service | 7045, Sysmon 1 | T1021.002 |
Measuring the Fan-Out
The count of distinct destinations per source in a short window is the strongest generic signal. Compute it from network logons and alert above your own measured ceiling, which for most estates is small:
index=wineventlog EventCode=4624 Logon_Type=3 Authentication_Package=NTLM OR Authentication_Package=Kerberos
| bin _time span=10m
| stats dc(ComputerName) as dest_hosts values(ComputerName) as sample by _time src_ip Account_Name
| where dest_hosts >= 15
| sort - dest_hosts
`comment("tune/validate: exclude vulnerability scanners, patching and monitoring servers by source address")`
Service Install and Payload Copy
PsExec installs a service on each target. A renamed copy changes the name but not the pattern: an executable written to ADMIN$ and a service installed seconds later. Join the two:
// Sentinel (KQL) - same service image installed on many hosts by one account
Event
| where EventLog == "System" and EventID == 7045
| extend ImagePath = tostring(EventData.ImagePath), ServiceName = tostring(EventData.ServiceName)
| where ImagePath has_any ("ADMIN$", "\\", "PSEXESVC") or ImagePath endswith ".exe"
| summarize hosts=dcount(Computer), first=min(TimeGenerated), last=max(TimeGenerated) by ServiceName, ImagePath
| where hosts >= 10 and datetime_diff('minute', last, first) <= 30
// tune/validate: software distribution tools also install services at scale
- Restrict outbound SMB and remote WMI from workstations and servers that have no administrative role.
- Alert on the first host in a fan-out, then isolate it; later hosts are the damage you already failed to prevent.
- Prepare an automated containment action for fan-out alerts, because human triage time can exceed the encryption window.
SigmaHQ PsExec and remote service rules, Elastic lateral-movement detections, Splunk ESCU remote execution analytics and MITRE CAR. Your patching and management tools produce legitimate fan-out, so baseline their source addresses and accounts before enforcing.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts