Multi-Stage Ransomware Precursor: Obfuscated PS/CMD to QEMU or Account Creation to Shadow Copy Deletion

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•12

This rule correlates suspicious process initiation originating from common web browsers or document handlers (e.g., encoded PowerShell, obfuscated CMD) with subsequent high-impact activities such as QEMU emulator launch, local account creation, DLL side-loading, volume shadow copy deletion, or creation of ransom-related files. This detection follows a multi-stage logic to identify potentially advanced threats or ransomware precursors within a 4-hour window.