Ransomware Attack: How to Detect It with SIEM Before It's Too Late
A ransomware kill chain plus 7 SIEM detection rules for catching RDP brute force, PowerShell abuse, and shadow copy deletion before files get encrypted.
Ransomware Attack: How to Detect It with SIEM Before It's Too Late
Ransomware is a serious cyber threat in Thailand right now — many organizations have paid ransoms running into millions of baht simply because they didn't catch the attack in time. This article walks through how to use SIEM to detect ransomware before it's too late.
How Does a Ransomware Attack Unfold?
Attackers follow a well-defined Ransomware Kill Chain. If your SIEM is configured correctly, it can catch every single stage:
| Stage | Activity | Logs You Can Detect It In |
|---|
| 1. Initial Access | Phishing email, RDP brute force | Email log, Event ID 4625 |
| 2. Execution | Running the payload, PowerShell | Event ID 4688, Sysmon |
| 3. Persistence | Creating a service, adding a scheduled task | Event ID 7045, 4698 |
| 4. Privilege Escalation | Gaining admin rights, DCSync | Event ID 4672, 4662 |
| 5. Lateral Movement | PsExec, RDP to other machines | Event ID 4624 (Type 3) |
| 6. Exfiltration | Sending data out | Firewall log, DNS log |
| 7. Encryption | Encrypting all files | File audit log, SIEM alert |
7 Detection Rules for Ransomware
Rule 1: RDP Brute Force
Condition: Event ID 4625 (Failed Login) > 20 times in 5 minutes
+ Login Type = 10 (Remote Desktop)
Severity: HIGH
Action: Block IP + alert immediately
Rule 2: Suspicious PowerShell
Condition: Event ID 4688 (Process Creation)
+ CommandLine contains: "-enc", "IEX", "DownloadString", "Invoke-"
Severity: CRITICAL
Action: Alert SOC + kill process
Rule 3: New Service Created
Condition: Event ID 7045 (New Service Installed)
+ Service Name is not in the whitelist
Severity: HIGH
Action: Alert + investigate
Rule 4: Mass File Encryption
Condition: File audit log shows:
+ File renames > 100 files in 1 minute
+ Extensions changing to .encrypted, .locked, .crypto
Severity: CRITICAL
Action: Alert + isolate host immediately
Rule 5: Shadow Copy Deletion
Condition: Event ID 4688
+ CommandLine contains: "vssadmin delete shadows"
Severity: CRITICAL
Action: Alert immediately — ransomware is deleting your backups!
Rule 6: Unusual Outbound Traffic
Condition: Firewall log shows:
+ Outbound data > 1GB in 1 hour
+ Destination = a country you've never had traffic to before (Russia, North Korea, Iran)
Severity: HIGH
Action: Block + alert
Rule 7: Abnormal Domain Admin Login
Condition: Event ID 4624 (Login Success)
+ Username = Domain Admin
+ Source IP is not the usual admin workstation
Severity: CRITICAL
Action: Alert immediately
Incident Response — What to Do When You Detect Ransomware
- Isolate — disconnect the infected machine from the network immediately
- Contain — disable RDP, rotate every admin password
- Investigate — use SIEM to trace exactly how the attacker got in
- Eradicate — remove the malware, close the vulnerability that let it in
- Recover — restore from backup
- Report — file a report as required under Thailand's Computer-Related Crime Act (พ.ร.บ. คอมพิวเตอร์)
⭐ zcrLog Detects Ransomware
zcrLog ships with ready-made detection rules built for ransomware:
- ✅ Sigma Rules — detect known ransomware patterns
- ✅ AI Rule Generation — automatically build new rules
- ✅ MITRE ATT&CK Mapping — visualize the attack stages
- ✅ Alerts via LINE, Microsoft Teams — get notified the instant it happens
- ✅ Attack Map — see where the attack is coming from
📖 Read more: What Is MITRE ATT&CK?
🎯 See zcrLog →
📞 Free Consultation
Related articles
Continue with these related guides for the comparison and operating detail:
Related product
See zcrLog for the product scope, the pricing page for published prices, and the inputs to confirm with your delivery partner