How do you detect ransomware before it encrypts?

Detect ransomware precursors — the sabotage that precedes encryption. Alert critically on shadow-copy deletion (vssadmin delete shadows, wmic shadowcopy delete), boot-recovery disabling (bcdedit recoveryenabled no), and backup deletion (wbadmin delete), which have almost no legitimate interactive use. Alert on bulk stopping of security/backup/database services and on EDR-sensor tamper. Detect mass encryption behaviourally via high-rate file renames, extension changes or entropy spikes, with canary files as tripwires. SigmaHQ and Splunk ESCU provide vetted rules.

Detecting Ransomware Precursors: The Actions Before Encryption

Ransomware operators sabotage recovery before they encrypt: deleting volume shadow copies, stopping backup services, disabling boot recovery and mass-touching files. This pack covers those precursors — the last high-fidelity window to intervene. It complements our ESXi/Linux ransomware and BYOVD coverage.

Signals at a Glance

Precursor	Signal	ATT&CK
Delete shadow copies	`vssadmin delete shadows`; `wmic shadowcopy delete`	T1490
Disable boot recovery	`bcdedit /set recoveryenabled no`; `bcdedit ... bootstatuspolicy ignoreallfailures`	T1490
Delete backups	`wbadmin delete catalog`; backup-service stop	T1490
Stop services/processes	Bulk stop of security/DB/backup services	T1489
Mass encryption	High-rate file renames; extension changes; entropy spike	T1486

Recovery Sabotage

The clearest precursor is tampering with recovery. Alert high on shadow-copy deletion and boot-recovery disabling — these have almost no legitimate interactive use:

title: Ransomware Recovery Sabotage
logsource:
    category: process_creation
    product: windows
detection:
    vss:
        CommandLine|contains|all: ['vssadmin','delete','shadows']
    bcd:
        CommandLine|contains|all: ['bcdedit','recoveryenabled','no']
    wbadmin:
        CommandLine|contains|all: ['wbadmin','delete']
    condition: vss or bcd or wbadmin
level: critical

Service Kills & Mass Encryption

Alert on bulk stopping of security, database and backup services (often via net stop, sc, taskkill or a packaged killer) — and treat EDR-sensor tamper as a ransomware precursor (see BYOVD).
Detect mass encryption behaviourally: a single process renaming or writing to very many files quickly, changing extensions, or a file-entropy spike; canary files in sensitive shares are a high-fidelity tripwire.
On ESXi, alert on esxcli/vim-cmd powering off VMs and deleting snapshots off-hours.

Vetted sources

SigmaHQ ships shadow-copy/bcdedit/wbadmin rules; Splunk ESCU has ransomware analytic stories; many EDRs include canary/mass-encryption behavioural detections.

Catch Ransomware in the Last Window

Mjolnir Security helps organisations detect the precursors that fire just before encryption.

Detection EngineeringManaged Detection & ResponseRansomware ReadinessThreat HuntingIncident Response

Detection Engineering Building recovery-sabotage and mass-encryption detections.
Ransomware Readiness Backups, canaries and the controls behind detection.
24/7 Incident Response Containment when ransomware precursors fire. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026