Detect FIVEHANDS by monitoring for suspicious SMB, remote service, and PowerShell activity linked to post-exploitation and ransomware deployment. Review endpoint telemetry for privilege escalation, remote execution, archive creation, and disabling of recovery options. Correlate these signals with abnormal authentication patterns and file encryption behaviour across multiple hosts.
What FIVEHANDS detection looks like in practice
FIVEHANDS is usually detected by combining host, identity, and file activity rather than relying on one indicator. Focus on the sequence: initial administrative abuse, remote execution, staging of payloads, then encryption and recovery suppression. The most useful detections are behavioral, because many of the individual tools and commands used in post-exploitation can also appear in legitimate administration.
Start with endpoint telemetry that shows unusual SMB use, remote service creation, and PowerShell launched from management or scripting contexts. Those signals become much stronger when they appear on multiple hosts in a short window, especially if the same source account or source system is driving repeated execution. A broader hunting baseline such as MITRE ATT&CK Enterprise Matrix helps teams map the observed sequence to privilege escalation, lateral movement, and impact techniques.
File activity matters just as much as process activity. Archive creation, bulk file renaming, unusual write bursts, and the sudden appearance of encrypted or partially encrypted files often appear after the actor has finished staging. Correlate that with attempts to disable recovery options, tamper with shadow copies, or otherwise reduce the victim's ability to restore data. When those behaviors align with remote execution and authentication anomalies, the case for active ransomware deployment becomes much stronger.
Where the signal becomes trustworthy
The key is correlation across multiple telemetry layers. A single PowerShell command or one remote service event is often too noisy to action on its own. Detection improves when endpoint logs, authentication logs, and file system events show a coordinated pattern, such as one account authenticating abnormally, several systems receiving the same remote command pattern, and then those systems beginning to encrypt data or lose recovery capabilities.
Teams should also watch for changes in the attacker's operational rhythm. FIVEHANDS activity is more credible when remote execution is followed quickly by archival staging, service manipulation, and rapid encryption spread. That timing is important because it separates ordinary admin tooling from a compromise chain that is being used to prepare and execute ransomware.
A practical detection program also benefits from a reference view of ransomware behavior. NHIMG's Ransomware Groups Guide is useful for understanding how ransomware crews commonly combine access, staging, and impact operations, which helps analysts decide whether a cluster of alerts is an intrusion or simply routine administration.
How to hunt without drowning in noise
Good hunts start by grouping by host, user, and time window. Look for the same account creating services, invoking PowerShell remotely, touching many hosts, and then generating archive or encryption patterns. If those actions are paired with abnormal authentication patterns, especially from systems that do not normally administer those targets, the activity deserves immediate escalation.
Do not wait for a perfect ransomware signature. Many defenders miss the early stages because they search only for encryption artifacts and ignore the setup work. The more useful hunt is often the one that catches privilege escalation, remote execution, and mass staging before full encryption begins. That gives you more time to isolate affected hosts and limit blast radius.
Risk and Threat Considerations
FIVEHANDS-style activity is dangerous because the same control channels used for legitimate administration, such as remote services and PowerShell, can be reused to move fast across many endpoints. Once an attacker has that foothold, the damage usually shifts from single-host compromise to coordinated encryption, recovery suppression, and operational disruption.
Failure mechanism: The actor blends remote execution, privilege abuse, and staging into ordinary-looking administrative traffic, then uses those same paths to deploy ransomware across multiple hosts before defenders can separate malicious activity from normal management.
Impact: Analysts may see late-stage encryption only after recovery options have already been disabled, which shortens containment time, expands downtime, and increases the likelihood of broad file loss and business interruption.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | FIVEHANDS detection relies on remote service abuse and lateral movement patterns. |
| T1059 — Command and Scripting Interpreter | PowerShell execution is a core detection signal in post-exploitation chains. | |
| T1486 — Data Encrypted for Impact | The question is about detecting ransomware deployment and file encryption behavior. | |
| Recommendation — Map remote service activity to lateral movement techniques and alert on cross-host execution bursts. Correlate suspicious PowerShell execution with privilege escalation and staging events. Treat encryption behavior as impact-stage evidence and pair it with preceding intrusion telemetry. | ||
| NIST CSF 2.0 | DE.CM-01 — The organization monitors networks and systems to detect potential cybersecurity events. | Detection of FIVEHANDS depends on continuous monitoring of host and network events. |
| DE.AE-02 — Detected cybersecurity events are analyzed to understand attack targets and methods. | Analysts must correlate SMB, PowerShell, authentication, and encryption signals into one attack story. | |
| Recommendation — Monitor endpoint and authentication telemetry for coordinated compromise indicators. Correlate multi-host telemetry to distinguish ransomware preparation from routine administration. | ||
Practitioner Guidance
What to prioritize: Build detections around the chain, not the isolated event. A suspicious SMB connection, remote service action, or PowerShell launch is worth triage when it is followed by privilege gain, archive creation, or recovery tampering on the same host or account.
What to verify: Confirm whether the source account normally administers those systems, whether the target hosts normally receive remote service creation, and whether file activity shows encryption-like bursts or mass rename behavior. Those three checks usually separate benign admin work from an intrusion that is already turning into ransomware.
Practitioner takeaway: The best FIVEHANDS detections are sequence-based, because the highest-confidence warning is the combination of remote execution, privilege escalation, staging, and recovery suppression across multiple hosts.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org