Ransomware Kill-Chain Correlation and Sequencing Alerts

Each precursor on its own has legitimate explanations: administrators run discovery commands, backup tools delete old data, security teams touch LSASS. The same events in a specific order on the same host or account within a few hours have very few. This page shows how to express that order, score it and route it to a responder.

Signals at a Glance

Expressing the Sequence

Sigma correlation rules reference base rules by name and group by an entity field. An ordered sequence of three stages on one computer within four hours looks like this, with the base rules defined separately:

title: Discovery Then Credential Access Then Lateral Fan-Out
name: ransomware_precursor_sequence
status: experimental
correlation:
  type: temporal_ordered
  rules:
    - discovery_burst
    - lsass_access_suspicious
    - remote_service_fanout
  group-by:
    - ComputerName
  timespan: 4h
level: critical
# tune/validate: each referenced rule needs a name field and a stable ComputerName mapping;
# convert with your backend and verify it supports temporal_ordered

Order matters less than coverage for many backends, so also keep an order-independent version that only requires distinct stages inside the window.

Risk-Based Alerting

When a backend lacks sequence support, score each precursor against an entity and alert on the sum and on the number of distinct ATT&CK techniques:

index=risk
| stats sum(risk_score) as total dc(mitre_technique_id) as techniques values(mitre_technique_id) as ttps values(source) as detections by risk_object risk_object_type
| where total >= 100 AND techniques >= 3
| sort - total
`comment("tune/validate: field names follow common risk-index conventions; weights should rise for backup deletion, GPO change and LSASS access")`

• Weight scores by stage, not by individual rule: a late-stage action should move the score more than a discovery command.
• Group by more than one entity. A sequence that moves from workstation to server to domain controller shows up only if account is a grouping key too.
• Send the correlated alert to a separate high-urgency queue with an automated containment option attached.
• Review every fired correlation and every near miss monthly; they tell you which inputs need better tagging.