How can security teams detect Ramsay?

What Ramsay detection looks like in practice

Ramsay is usually detected through behaviour, not a single signature. The most useful signal is a chain of suspicious activity on endpoints that touch sensitive files: document discovery, collection, archiving, staging, and outbound transfer. That pattern becomes stronger when it appears on a host that normally does not perform bulk file handling or when the activity aligns with Malware Guide detection patterns for file-moving malware families.

Look for unusual compression, self-extracting archives, script-driven automation, and file renaming that appear shortly before exfiltration. Ramsay-style activity often hides in ordinary admin tools, so defenders should treat PowerShell, command shells, archive utilities, and scripting interpreters as context markers rather than proof on their own.

Endpoint telemetry is most valuable when it shows an uncommon process tree: user application, then script or shell, then archive or copy utility, then network transfer or removable-media access. That sequence is more meaningful than any single process event because it reflects staging behaviour, which is often the point where collection activity becomes visible.

Which signals best separate Ramsay from normal admin activity?

The practical distinction is intent. Legitimate administration may copy files or run scripts, but it rarely does so in a concentrated pattern against sensitive documents, across multiple directories, and immediately before outbound transfer. Correlating file access, archive creation, and network activity helps separate routine maintenance from data theft preparation.

Pay special attention to endpoints that have access to document repositories, finance folders, legal shares, or other high-value data stores. If those systems suddenly begin creating archives, spawning scripting processes, and writing to temporary or staging locations, the behaviour is worth escalation even if no malware name is confirmed yet.

Removable media use is another useful discriminator. When file staging lines up with USB insertion, external drive write activity, or other removable storage events, the endpoint may be preparing to move data off the network through a route that avoids conventional egress monitoring. In that case, the question is not only whether the host is infected, but also whether the data path has already been used.

How should teams confirm and scope suspicious activity?

Start by building a short timeline around the first unusual file event. Identify what was accessed, which process created or touched the archive, where the staging files were written, and whether the same host made unusual outbound connections shortly after. This turns a vague alert into a concrete incident hypothesis.

Then compare the endpoint against its normal baseline. A workstation that normally opens documents should not suddenly behave like a file transfer node, especially if the same user context is also spawning shells or automation tools. If the host belongs to a privileged or document-heavy user, the review should extend to nearby systems, shared folders, and any account reuse that could let the same workflow repeat elsewhere.

When collection looks credible, preserve endpoint artifacts before remediation if possible: relevant process data, file hashes, archive names, shell history, recent network connections, and evidence of removable-media activity. That evidence helps determine whether the event is isolated staging, an attempted transfer, or part of a wider intrusion.

Risk and Threat Considerations

Ramsay is dangerous because it combines low-friction collection with ordinary-looking tooling. That makes it easier to blend in with normal user and admin activity, especially in environments where file handling, scripting, and outbound transfer are all common.

Failure mechanism: The malware stages sensitive files locally, compresses or packages them, and uses script or shell activity to prepare exfiltration through network channels or removable media. If defenders only hunt for malware binaries, they can miss the staging phase where the compromise is most observable.

Impact: Early warning is lost, data theft may proceed unnoticed, and the same access path can be reused against additional document stores or endpoints. In a targeted intrusion, that can turn a single suspicious workstation into a broader confidentiality incident.

Practitioner Guidance

What to verify: Confirm the exact file sequence, the parent-child process chain, and the destination of the staged data. If you cannot explain why a host created archives or temporary bundles of sensitive documents, treat that as a real investigative lead rather than an anomaly to file away.

Decision rule: If file staging, scripting, and outbound transfer appear together on a system that handles sensitive documents, prioritise containment and evidence preservation before spending time on malware naming. The behavioural chain matters more than whether the sample is already identified.

What practitioners underestimate: Exfiltration often starts with local preparation, not with the network connection itself. Teams that monitor only perimeter traffic usually see the last step; teams that correlate endpoint behaviour with network and removable-media activity see the attack earlier.

Practitioner takeaway: The best Ramsay detections are behavioural and chained, not signature-only, so the key is to catch file staging before the data leaves the host.

Related resources from NHI Mgmt Group

• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?