When ransomware strikes, it doesn’t just encrypt files — it often wraps up with a series of stealthy moves meant to lock you out, cover tracks, and make recovery a nightmare. That’s why it’s so important to spot these final-stage activities before the damage is permanent.
The techniques below are commonly seen during the final stage of ransomware attacks, and I recommend setting them up as detection rules in your Defender XDR or Microsoft Sentinel environment. Some of these detections were created by me, while others come from great KQL experts like Michalis Michalos and Bert-Jan Pals .
This is just the beginning — there are many other techniques used in ransomware’s final stage, and new ones will likely emerge in the future. Let’s take a look at some cases of what these scenarios might look like
System Modification
During the system modification phase, ransomware often disables critical services like antivirus,Defender/Response systems, anti-malware or backup agents to avoid detection. Some variants go further by attempting to change boot settings using tools like bcdedit to disable recovery modes.These changes help ensure the attack survives reboots and maximizes disruption. Catching these early can give defenders a crucial opportunity to respond before encryption begins.
Boot Configuration Edits
Detect bcedit commands related to boot configuration (by Sergio Albea )
This KQL query is designed to detect adversaries attempt to modify the boot configuration using bcdedit commands. Such changes are often used to disable recovery options or suppress error messages after encryption, helping ransomware persist stealthily across reboot.
DeviceProcessEvents
| where ProcessCommandLine startswith “bcdedit”
Stop Services
One common activity observed in ransomware attacks is the attempt to disable or stop Defender XDR and other critical security services.Attackers often use commands like sc stop, sc config, or PowerShell with Set-MpPreference to turn off protections. This allows the ransomware to evade real-time detection and operate without interruption. Disabling services also helps prevent automatic response actions, like isolating the device or killing malicious process.
Detecting an attempt by the PowerShell process to disable services or components of Microsoft Defender (by Mahdi Haris Hutama )
DeviceProcessEvents
| where (FileName =~ “powershell.exe” and
ProcessCommandLine has_any (“Add-MpPreference”,“Set-MpPreference”) and
ProcessCommandLine has_any (“ExclusionProcess”,“ExclusionPath”)) or
(ProcessCommandLine has “powershell” and
ProcessCommandLine has_any (“Add-MpPreference”,“Set-MpPreference”) and
ProcessCommandLine has_any (“ExclusionProcess”,“ExclusionPath”)) or
(ProcessCommandLine has “sc” and ProcessCommandLine has “config” and ProcessCommandLine has “disabled”)
| summarize PowerShellDisableCount = dcount(ProcessCommandLine), PowerShellDisableList = make_set(ProcessCommandLine),
ReportId = any(ReportId) by DeviceId, bin(Timestamp, 5m)
| where PowerShellDisableCount > 10
Data Exfiltration
Another common step after a hacker has established control or a connection to a computer is information gathering and data exfiltration. This can happen in various ways. One typical method involves exporting data to local files — such as .csv, .txt, or similar formats — which can then be exfiltrated using different channels, including web-based file transfers, email, or even RDP sessions.
Detecting Text and CSV Data Dumps via Command Line (by Sergio Albea )
This KQL query is designed to detect instances where a device exports data into text (.txt) or CSV (.csv) files via command line operations. This activity can be an early indicator of ransomware attacks, as attackers often gather internal data before attempting to exfiltrate it.
DeviceEvents
| where isnotempty(AdditionalFields)
| extend Command = tostring(parse_json(AdditionalFields).Command)
// search for commands exporting data into .txt or .csv format
| where Command endswith “.txt” or Command endswith “.csv”
// excluding known cases
| where Command !startswith “Start-Process”
| project Timestamp, DeviceName, ActionType, ProcessCommandLine, Command, InitiatingProcessAccountName, InitiatingProcessAccountUpn, ProcessRemoteSessionDeviceName, ReportId
Rdp Enable By Modifying Registry Key (by Michalis Michalos )
This is an effective detection, especially if RDP is disabled by default on your devices, as it allows you to identify any attempts to modify the system and enable the RDP service.
let rdpcommands = dynamic([@“fDenyTSConnections”, @“REG_DWORD /d 0”]);
DeviceProcessEvents
| where FileName has @“reg.exe”
| where ProcessCommandLine has_all (rdpcommands)
| project DeviceId, DeviceName, ProcessCommandLine, Start = Timestamp
| join kind = inner (DeviceRegistryEvents
| where RegistryKey == @“HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server”
| where RegistryValueName == @“fDenyTSConnections”
| where ActionType == @“RegistryValueSet”
| where RegistryValueData == @“0”
| where InitiatingProcessFileName == @“reg.exe”
| project DeviceId, End = Timestamp)
on DeviceId
| where (End - Start) between (0min … 1min)
| project Start, DeviceId, DeviceName, ProcessCommandLine
Remove Evidence
Before starting with the real damage of encrypting the computer files, one of the steps is to remove possible evidence or clues about how the hackers were able to take control of the computer. One of the most common methods is removing the logs, which can be done manually or using the wevtutil command. On the other hand, removing information about recently run programs helps to hide which tools were used during this process, as this data is stored in Prefetch files.
Clean Event Logs Manually (by Sergio Albea )
DeviceEvents
| where ActionType has “SecurityLogCleared”
Clean Event Logs by wevutil command (by Bert-Jan Pals )
DeviceProcessEvents
| extend ProcessCommandLineToLower = tolower(ProcessCommandLine)
| where ProcessCommandLineToLower has “wevtutil.exe” and ProcessCommandLineToLower has_any (“cl”, “clear-log”)
| project-reorder Timestamp, DeviceName, AccountSid, ProcessCommandLine, InitiatingProcessCommandLine
Delete evidence of executed programs
A typical technique used by ransomware operators is the deletion of Prefetch files, which track recently executed programs .
By running commands like ‘del C:\Windows\Prefetch*.pf’, attackers attempt to erase forensic traces of tools they’ve used. This behavior is aimed at hindering investigation and slowing down incident response.
Detect Prefetch Deletion Attempt (by Sergio Albea )
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_all (“del”, “C:\Windows\Prefetch”, “.pf”)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, ReportId
Encryption Phase
For this stage of the ransomware encryption, I am sharing 2 KQL queries developed and shared by the KQL expert Bert-Jan Pals . One of the things a ransomware attack wants to ensure 100% is that you are not able to recover your system, so they will try to delete possible backups. On the other hand, of course, there is the corresponding detection to identify file extension changes with known ransomware names.
Triggers when a known ransomware extension has been found (by Bert-JanP )
A reliable way to detect active ransomware is by monitoring for known encrypted file extensions used during attacks. This technique identifies when files are renamed with extensions linked to specific ransomware strains (e.g., .lockbit, .rhysida). It often indicates that the encryption phase has started, marking a critical point in the attack.
let RansomwareExtensionsInput = externaldata(Extension: string)[@“https://raw.githubusercontent.com/eshlomo1/Ransomware-NOTE/main/ransomware-extension-list.txt”] with (format=“txt”, ignoreFirstRecord=True);
let RansomwareExtensionAddition = dynamic([‘.misingfromabovelist’]); // Add your missing / new extensions in this list.
let RansomwareExtensions = materialize (
RansomwareExtensionsInput
| distinct Extension
| extend RawExtention = substring(Extension, 1,
string_size(Extension))
);
DeviceFileEvents
| where FileName has_any (RansomwareExtensions) or FileName has_any (RansomwareExtensionAddition)
| summarize
arg_max(Timestamp, ),
EncryptedFiles = make_set(FileName),
Locations = make_set(FolderPath)
by DeviceName
| extend TotalFileEncrypted = array_length(EncryptedFiles)
| project-reorder
Timestamp,
TotalFileEncrypted,
EncryptedFiles,
Locations,
InitiatingProcessAccountName
| sort by TotalFileEncrypted
Known Shadow Copy Delete command executed (by Bert-JanP )
A typical final-stage ransomware tactic involves deleting Volume Shadow Copies to prevent system recovery.Attackers execute commands like vssadmin delete shadows /all /quiet or wmic shadowcopy delete to erase backups. This ensures that victims cannot restore encrypted files after the attack completes. The technique is widely abused by ransomware families to increase impact and pressure victims into paying. Detecting these commands helps you respond before the attacker finishes erasing recovery options.
let CommonRansomwareExecutionCommands = dynamic([@‘vssadmin.exe delete shadows /all /quiet’,
@‘wmic.exe shadowcopy delete’, @‘wbadmin delete catalog -quiet’,
@‘Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}’,
@'del /s /f /q c:*.VHD c:*.bac c:*.bak c:*.wbcat c:*.bkf c:\Backup.* c:\backup*.* c:*.set c:*.win c:*.dsk’,
@‘wbadmin delete systemstatebackup -keepVersions:0’,
@‘schtasks.exe /Change /TN “\Microsoft\Windows\SystemRestore\SR” /disable’,
@‘schtasks.exe /Change /TN “\Microsoft\Windows\SystemRestore\SR” /enable >nul 2>&1’,
@‘reg add “HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore” /v “DisableConfig” /t “REG_DWORD” /d “1” /f’,
@‘reg add “HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore” /v “DisableSR” /t “REG_DWORD” /d “1” /f’,
@‘reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore” /v “DisableConfig” /t “REG_DWORD” /d “1” /f’,
@‘reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore” /v “DisableSR” /t “REG_DWORD” /d “1” /f’,
@‘reg delete “HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore” /v “DisableConfig” /f >nul 2>&1’,
@‘reg delete “HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore” /v “DisableSR” /f >nul 2>&1’,
@‘reg delete “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore” /v “DisableConfig” /f >nul 2>&1’,
@‘reg delete “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore” /v “DisableSR” /f >nul 2>&1’]);
DeviceProcessEvents
| where ProcessCommandLine has_any (CommonRansomwareExecutionCommands)
| project-reorder Timestamp, ProcessCommandLine, DeviceName, AccountName
Ransomware Notification
Once all ‘work’ is done, they notify the affected user or system of the successful compromise. The most common methods of delivering this message include changing the desktop background and leaving ransom note files with instructions for making the required payment to decrypt the encrypted data.
Detect suspicious actions to change Desktop Background (by Sergio Albea )
Changing a device background manually, is kind of expected user behaviour if you are allowing it. However, modify the associated register keys via command line, can be a good indicator about a Ransomware activity. Both of following cases, are commonly abused by ransomware (e.g., Rhysida,BlackCat) to control or lock desktop wallpaper settings.
DeviceProcessEvents
| where ProcessCommandLine has_any ( “reg delete "HKCU\Control Panel\Desktop"”, “reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop"”, “NoChangingWallPaper”)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName, ReportId
Detect suspicious files dropped into Public Folder (by Sergio Albea )
Another common behaviour is dropping ransom notes in the C:\Users\Public folder to notify about the encryption and the details for the corresponding payments. I recommend you to execute this KQL query to see if you have some false positive to whitelist them as I have with .lnk files ( basically browser shortcuts)
DeviceEvents
| where FolderPath contains “Users\Public” and FileName !endswith “.lnk”
| distinct DeviceName, ActionType, FileName, FolderPath
Conclusion
Detecting ransomware early is important — but catching it in its final stage is often your last and only opportunity to respond before permanent damage occurs.
By monitoring for the techniques listed above — such as boot configuration changes, log deletion, backup tampering, and ransom note delivery — you can still detect and respond to an active attack, even if the initial compromise went unnoticed.
Building and maintaining these detections will not only help reduce the impact of a successful breach, but also improve your incident response time and increase your chances of stopping ransomware before it fully completes its mission.
Additionally, in real-world scenarios, some of the attacker’s actions might fail on the first attempt due to timing, permission issues, or misconfigurations. In those critical moments, having the right detection rules in place can alert you quickly, giving your security team the chance to respond immediately before the attacker tries again.
Identifying Ransomware Final Stage activities with KQL Queries was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Article Link: Identifying Ransomware Final Stage activities with KQL Queries | by Sergio Albea | Jul, 2025 | Detect FYI