Project Summary

This project demonstrates ransomware behavior simulation using a custom PowerShell script on a Windows 10 machine. The simulator encrypts target files, renames them with a .encrypted extension, attempts to delete shadow copies, and drops a ransom note on the Desktop. Detection is achieved through Wazuh FIM (File Integrity Monitoring) in realtime mode and Sysmon endpoint telemetry, mapped to the MITRE ATT&CK framework.

Overview

This lab highlights a critical detection principle: ransomware is identified not by a single malicious file, but by the velocity and pattern of file modifications. Wazuh FIM fired 12 alerts in under 1 second — a behavioral pattern impossible to mistake for normal user activity.

The objective was to demonstrate that behavioral detection via FIM realtime monitoring catches ransomware activity at the moment of encryption — before the damage is complete.

Lab Environment

RoleOSIPTools
AttackerWindows 10 (VM)192.168.0.29PowerShell 5.1 (ransomware simulator)
VictimWindows 10 (VM)192.168.0.29Sysmon v15, Wazuh Agent 004
SIEMUbuntu Server (VM)—Wazuh 4.x

Note: Attack and victim are on the same machine — simulating an insider threat or post-exploitation scenario where the attacker already has local access.

Attack Simulation

The PowerShell simulator performs three core ransomware behaviors:

  1. Shadow copy deletion — vssadmin delete shadows /all /quiet (T1490)
  2. File encryption — reads each file, Base64 encodes content, overwrites and renames to .encrypted
  3. Ransom note drop — creates README_RANSOM.txt in target folder and on Desktop
PowerShell ransomware simulator — files encrypted in sequence, ransom note dropped.
10 files renamed to .encrypted extension with README_RANSOM.txt in the target folder.
Ransom note content — YOUR FILES HAVE BEEN ENCRYPTED — dropped on Desktop and in target folder.

Detection Results

Sysmon Event ID 1 — PowerShell Process Creation

Sysmon captured the PowerShell process that executed the ransomware simulator with IntegrityLevel: High — indicating elevated execution context.

  • Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  • IntegrityLevel: High
  • ParentImage: C:\Windows\explorer.exe
  • User: WINDOWS\vboxuser
Sysmon Event ID 1 — PowerShell process creation with IntegrityLevel High.

Wazuh FIM — Rule 550: Mass File Modification

Wazuh FIM detected 12 integrity checksum change events in rapid succession — the velocity pattern characteristic of ransomware encryption. Normal user activity does not modify 10+ files simultaneously.

  • Rule ID: 550 — Integrity checksum changed
  • Rule Level: 7
  • MITRE ID: T1565.001 — Stored Data Manipulation
  • MITRE Tactic: Impact
  • Mode: realtime
Wazuh FIM — 12 Rule 550 alerts in under 1 second, MITRE T1565.001 Impact tactic.

Wazuh FIM — Ransom Note Detection

Wazuh FIM detected the ransom note file on the Desktop in realtime:

File 'c:\users\vboxuser\desktop\readme_ransom.txt' modified
Mode: realtime
Changed attributes: mtime
Wazuh FIM realtime detection of readme_ransom.txt — ransom note identified immediately upon creation.

MITRE ATT&CK Techniques Observed

Technique IDName
T1486Data Encrypted for Impact — 10 files encrypted, renamed to .encrypted
T1565.001Stored Data Manipulation — Wazuh Rule 550, 12 alerts, Impact tactic
T1490Inhibit System Recovery — vssadmin delete shadows /all /quiet
T1059.001Command and Scripting Interpreter: PowerShell — Sysmon EID 1, IntegrityLevel High

Key Findings

  • A custom PowerShell ransomware simulator successfully encrypted 10 target files and dropped a ransom note.
  • Wazuh FIM Rule 550 fired 12 alerts in under 1 second — the velocity of simultaneous file modifications is the key ransomware behavioral indicator.
  • Wazuh FIM realtime mode detected the ransom note immediately upon creation on the Desktop.
  • Sysmon EID 1 captured the PowerShell process with IntegrityLevel: High.
  • Key lesson: Ransomware detection relies on behavioral patterns — specifically the velocity of file modifications. A single file change is normal; 12 changes in under 1 second is an incident.

Full Technical Project

GitHub

Scroll to Top