Ransomware Early Warning Signs: Detect Before Encryption

By the time files are being encrypted, the attacker has usually been inside for days, stealing credentials, mapping the network, removing recovery options and taking data, and every one of those steps left evidence that was not acted on. Human-operated ransomware is a hands-on intrusion that ends in encryption, so the best chance to stop it is during the precursor stages. This guide consolidates those precursors into one detection plan: what each stage looks like in Windows, identity, network and cloud telemetry, which signals deserve an immediate response, how to tune them, and how to measure whether you would catch an intrusion in time. It is for SOC analysts, detection engineers and incident responders. For hardening, see the Ransomware Prevention Guide; for what to do once encryption starts, see the Ransomware Response and Recovery Guide.

Key takeaways

Encryption is the last step, not the attack. Microsoft describes human-operated ransomware as an active attack in which criminals infiltrate the environment, elevate privileges and then deploy ransomware, which means the earlier stages are where detection pays off.
A handful of signals are near-certain precursors. Shadow copy and backup deletion, security tools being stopped, new domain administrators, LSASS access and unapproved remote access tools rarely have a benign explanation and should page someone, not wait in a queue.
Exfiltration now comes before encryption. CISA's #StopRansomware advisories describe double extortion, so large outbound transfers with tools such as Rclone are an early warning in their own right.
Correlate, do not just alert. A single discovery command is noise; discovery, then credential access, then a new remote session from the same account within hours is an intrusion.
Test your coverage against real playbooks. Map detections to the techniques in recent advisories, emulate them, and measure how many stages you would have seen before impact.

Why ransomware gives early warning

Microsoft separates commodity ransomware, which spreads like malware and is cleaned up by malware remediation, from human-operated ransomware, which is "hands-on-keyboard", targets an organisation rather than a device, and needs complete adversary eviction. Its stages (initial compromise, persistence and defence evasion, lateral movement, credential access, data theft and impact) take time and generate activity that differs from normal administration.

The timeline can be short or long. The Change Healthcare breach began with a Citrix login without MFA on 12 February 2024, and ransomware was deployed nine days later after lateral movement and data theft. In the Colonial Pipeline attack, access through a dormant VPN account was followed by the theft of nearly 100 GB of data before ransomware was deployed. Both left a window in which precursor detection could have changed the outcome.

The CISA #StopRansomware Guide also warns that a ransomware event may indicate an earlier, unresolved compromise by dropper malware such as QakBot, Emotet or Bumblebee. A loader infection that was "cleaned" without a hunt for follow-on activity is itself an early warning.

Precursor stages and what to look for

The table below maps each stage to observable signals, drawn from the CISA #StopRansomware Guide, the joint #StopRansomware advisory on Medusa (March 2025) and ATT&CK v20. Technique IDs are listed so you can map detections to coverage.

Stage	ATT&CK	Early warning signals	Primary telemetry
Initial access	T1133 External Remote Services, T1078 Valid Accounts	Anomalous VPN or remote access logins: new country, impossible travel, dormant account, login without MFA, first-seen device	VPN, IdP and remote access gateway logs
Tooling and command and control	T1219 Remote Access Tools, T1105 Ingress Tool Transfer, T1572 Protocol Tunneling	Unapproved RMM tools or portable RMM executables, tunnelling tools such as Cloudflared, Chisel or Ligolo, Cobalt Strike beacons named like Windows processes	EDR process and network events, DNS and proxy logs
Discovery	T1046, T1018, T1087.002, T1069.002, T1482	Network scanners (Advanced IP Scanner, SoftPerfect), enumeration of domain admins and domain controllers, domain trust queries, sudden SMB fan-out from one host	EDR command lines, Windows 4688, network flow
Credential access	T1003.001 LSASS Memory, T1003.006 DCSync, T1558.003 Kerberoasting	Handles to LSASS from unusual processes, NTDS.dit access or NTDSutil, replication requests from non-DC hosts, bursts of service ticket requests with RC4	EDR, Sysmon process access, 4662, 4769
Privilege and persistence	T1136.002, T1098, T1053.005, T1569.002	New domain accounts, additions to Domain Admins or other privileged groups, new services and scheduled tasks on many hosts	4720, 4728, 4732, 4756, 4697, 4698
Lateral movement	T1021.001 RDP, T1021.002 SMB/Admin Shares, T1047 WMI, T1570	PsExec run as SYSTEM, RDP enabled through registry or firewall changes, unexpected workstation-to-workstation or server-to-server sessions, software deployment tools used outside change windows	4624 logon types 3 and 10, EDR, flow logs
Defence impairment	T1685 Disable or Modify Tools, T1685.005 Clear Windows Event Logs, T1112	Antivirus or EDR services stopped, vulnerable drivers loaded, audit policy changed, Security log cleared, PowerShell history deleted	1102, 4719, EDR tamper alerts, driver load events
Data staging and exfiltration	T1560.001, T1567.002 Exfiltration to Cloud Storage, T1048	Archiving of large file sets, Rclone, Rsync or FTP/SFTP clients, abnormal outbound volume on any port	EDR, proxy, firewall and flow logs, cloud storage logs
Recovery inhibition	T1490 Inhibit System Recovery, T1489 Service Stop	vssadmin, wbadmin, bcdedit, fsutil or wmic used against shadow copies, backups or boot configuration; backup, database and security services stopped	EDR command lines, 4688, backup console audit logs

High-fidelity signals that should page someone

Most precursor signals need correlation. A short list does not: in most environments these behaviours have no routine explanation, and the response should start within minutes, at any hour.

Shadow copy or backup deletion: the CISA guide names misuse of bcdedit.exe, fsutil.exe, vssadmin.exe, wbadmin.exe and wmic.exe as a common sign, and the Medusa advisory lists shadow copy deletion with vssadmin among the impact behaviours. Pair host telemetry with alerts from the backup platform itself on deleted jobs, shortened retention or disabled immutability. See the Backup Identity Isolation Guide.
Security tooling disabled or tampered with: EDR or antivirus stopped on several hosts, tamper protection alerts, or a known vulnerable driver loaded. The Medusa advisory describes actors killing or deleting EDR using vulnerable or signed drivers. See the EDR Tampering and BYOVD Response Playbook.
Security log cleared or audit policy changed: Microsoft lists event 1102 (the audit log was cleared) as medium to high criticality and 4719 (system audit policy was changed) as high.
New privileged account or group membership outside change control: 4720 followed by 4728, 4732 or 4756 adding the account to an administrative group, especially out of hours. The CISA guide lists new or newly privileged AD accounts and recent Domain Admin activity as indicators.
LSASS access or directory replication from an unexpected host: credential dumping almost always precedes domain-wide deployment. See the Credential Dumping Guide.
Canary hits: any use of a honeytoken account, canary credential or decoy share is a high-confidence signal of discovery or credential theft. See the Honeytokens and Canary Credentials Guide.

Correlation rules that catch an intrusion in progress

Individually weak signals become strong when they occur together on the same account or host within a short window. Build these as correlation rules or hunting queries, and tune the windows to your environment.

Sequence	Why it matters	Suggested response
Anomalous remote access login, then discovery commands from the same account within hours	Initial access followed by reconnaissance	Disable session, reset credentials, hunt from that host
New RMM or tunnelling tool on a host, then outbound connection to a new external destination	Persistent hands-on access channel	Isolate host, block destination, check for the tool elsewhere
Kerberos service ticket burst (4769) from one account, then logons with a service account from new hosts	Kerberoasting followed by use of cracked credentials	Rotate service account passwords, review its access
Same account creating services or scheduled tasks (4697, 4698) on many hosts in a short period	Lateral movement or deployment staging	Treat as active intrusion; contain the account
Archive creation on a file server, then large outbound transfer	Data staging and exfiltration	Block egress, preserve evidence, start data exposure scoping
Any two of: backup deletion, security tool stop, log clearing, within one day	Pre-encryption preparation	Invoke the ransomware playbook immediately

Kerberoasting detection, Cobalt Strike indicators and lateral movement analytics each have their own depth. See the Kerberoasting and AS-REP Roasting Defence Guide, the Cobalt Strike Abuse Detection Guide and the Lateral Movement Guide.

Telemetry you need before any of this works

Detections fail silently when the logs are not there. The CISA #StopRansomware Guide recommends retaining and securing logs from network devices, hosts and cloud services, keeping critical system logs for at least one year where possible, correlating them in a central SIEM, and baselining normal network traffic.

Windows Security log: process creation (4688) with command line, logons (4624, 4625, 4648), privileged logons (4672), account and group changes (4720, 4728, 4732, 4756), service and task creation (4697, 4698), Kerberos service tickets (4769), directory object access (4662) and log clearing (1102). The System log records service installation as event 7045. See the Windows Event Log Guide.
PowerShell: the CISA guide recommends module, script block and transcription logging, with the PowerShell Windows event and Operational logs retained for at least 180 days, and regular checks that logs have not been deleted or disabled. See the PowerShell Security Guide.
Endpoint: EDR on every server and workstation, or Sysmon where EDR is absent, for process access to LSASS, driver loads, file creation and network connections. See the Sysmon Guide.
Network: flow data for east-west traffic, SMB monitoring, DNS and proxy logs, and firewall logs for outbound volume.
Identity and remote access: VPN, IdP and remote access gateway sign-ins, with MFA outcome and device.
Hypervisors and backup platforms: ESXi and vCenter logs, and backup console audit logs, which are often outside EDR coverage. See the ESXi Logs Detection Guide.
Cloud: the CISA guide recommends tools that detect changes to IAM, network security and data protection resources, and automation that acts on new permissive firewall rules.

Where identity fits

Nearly every precursor stage is an identity event: a valid account logging in remotely, a service account being Kerberoasted, a new domain administrator, an RMM agent running under a privileged machine account. Detection improves when you know which accounts are expected to do what. Keep a list of privileged and service accounts with their normal hosts and hours, alert on deviations, and treat service accounts used interactively as suspicious. The identity side of hunting is covered in the Identity Threat Hunting Guide, and rebuilding trust after a domain compromise in Recovering IAM and PAM After Ransomware or Domain Compromise.

Building the detection programme in phases

Close telemetry gaps first: confirm command-line process logging, PowerShell logging, EDR coverage on servers, and log forwarding from VPN, IdP, hypervisors and backup consoles. Measure coverage before writing rules.
Deploy the high-fidelity signals: backup and shadow copy deletion, security tool tampering, log clearing, new privileged accounts and unapproved RMM tools. Run them in alert-only mode for two weeks, document legitimate sources (backup software, admin scripts) and suppress those narrowly by host and signed binary, never by tool name alone.
Write the response before the rule goes live: each high-fidelity alert needs a runbook with authority to isolate a host or disable an account out of hours. The CISA response checklist starts with identifying and isolating impacted systems and using out-of-band communication. See the Alert Triage Guide.
Add correlation rules from the sequence table, starting with remote access followed by discovery, and pre-encryption preparation.
Emulate and test: in an authorised test, replay the techniques from a recent advisory (discovery, a benign LSASS access test, service creation across hosts, a staged exfiltration to a test bucket) and record which stages were detected and how fast. Repeat after major logging or EDR changes.
Review after every incident and near miss: for each intrusion, list which precursors were present in the logs and why they did not fire or were not acted on.

Small organisations without a 24x7 SOC should prioritise EDR with vendor-managed response and the high-fidelity list, and ensure someone can act on them out of hours. Large organisations should invest in correlation and in hypervisor and backup platform telemetry, where intrusions increasingly finish. See the Detection Engineering Guide.

Detection and measurement

Metric	What it shows	Target direction
Precursor technique coverage	Share of techniques in the stage table with a tested detection	Rising; all high-fidelity signals covered
Telemetry coverage	Servers, workstations, hypervisors and backup consoles sending the required logs	Near 100% for servers and hypervisors
Time to respond to high-fidelity alerts	Minutes from alert to containment action, including out of hours	Falling; measured in minutes, not hours
Stages detected in emulation	How many precursor stages an exercise triggered before the simulated impact	Detection in the first two stages
Unapproved remote access tools found	RMM and tunnelling tools outside the approved list	Zero persistent findings

Common failure patterns

Alerts that fired and were closed: a new admin account or a scanner was flagged as low severity and closed as "IT activity" without asking IT.
Allow-listing by tool name: RMM tools, PsExec and archive utilities are suppressed because IT uses them, so attackers using the same tools are invisible. The Medusa advisory notes actors choose remote access tools that already exist in the victim environment.
Blind spots where encryption happens: hypervisors, NAS devices and backup servers without EDR or log forwarding. See the Bring Your Own Vulnerable Driver and EDR Killers Guide for why endpoint tooling alone is not enough.
Loader infections closed without a hunt: a QakBot or similar detection is remediated on one host and nobody checks for follow-on access.
No authority to act at night: the alert is seen at 02:00 but nobody can isolate a server until morning.
Exfiltration treated as a separate problem: large outbound transfers are a data loss alert in one queue and ransomware precursors in another. See the Data Exfiltration Guide.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	DE.CM-01, DE.CM-09, DE.AE-02, DE.AE-03	Monitoring networks and computing, analysing and correlating adverse events
NIST SP 800-53 Rev. 5	SI-4, SI-4(4), AU-2, AU-6, IR-4	System and communications monitoring, event logging and review, incident handling
CIS Controls v8.1	Control 8 Audit Log Management, Control 13 Network Monitoring and Defense	Collecting and reviewing the logs the detections depend on
MITRE ATT&CK v20	Defense Impairment (TA0112), T1490, T1486, T1003.001, T1219, T1567.002	Precursor and impact techniques to map coverage against

Practitioner checklist

Confirm command-line, PowerShell and EDR telemetry on every server, and log forwarding from VPN, IdP, hypervisors and backup consoles.
Deploy high-fidelity alerts for shadow copy and backup deletion, security tool tampering, log clearing and new privileged accounts.
Maintain an approved list of RMM and remote access tools and alert on anything else, including portable executables.
Alert on LSASS access, directory replication from non-DC hosts and Kerberos service ticket bursts.
Build correlation rules for remote access followed by discovery, and for pre-encryption preparation.
Monitor outbound volume and known exfiltration tools, and route those alerts to the same responders.
Give on-call responders written authority to isolate hosts and disable accounts out of hours.
Emulate techniques from a recent #StopRansomware advisory at least yearly and record which stages were detected.
Seed honeytoken accounts and canary shares to catch discovery and credential theft.

Standards and references

Related NHI Mgmt Group resources: Ransomware Prevention Guide · Ransomware Response and Recovery Guide · Alert Triage Guide · Ransomware Groups Guide

Ransomware Early Warning Signs: Detecting Precursors Before Encryption