Multi-Stage Ransomware Kill Chain Detection

Montaser Ismail@M0nt3x

•updated Aug 4, 2026•11•1•21

This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.