INC Ransom — Rapid Extortion Against Professional-Services Firms

Looks for: execution of the discovery utilities INC affiliates consistently run after foothold. Accomplishes: catches the recon phase well before encryption (T1046/T1087.002/T1018).

// HUNT: Internal recon tooling (NetScan / AdFind / Nltest)
// MITRE: T1046, T1087.002, T1018 | CONF: high  FP: low-medium  COST: low
// REQUIRES: ProcessRollup2 with command line
// TUNING: exclude known admin workstations and inventory service accounts
#event_simpleName=ProcessRollup2
| ImageFileName=/\\(netscan|adfind|nltest)\.exe$/i
   or CommandLine=/\b(adfind\b.*(-f |objectcategory)|nltest\s+\/dclist|netscan)/i
| !in(field=UserName, values=["svc-inventory","admin-scan"])
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Looks for: net user /add followed by elevation into Administrators / Domain Admins. Accomplishes: detects the affiliate persistence step (T1136) that survives credential resets.

// HUNT: New admin account creation + group elevation
// MITRE: T1136, T1098 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with command line
// TUNING: exclude provisioning service accounts and JML automation hosts
#event_simpleName=ProcessRollup2
| ImageFileName=/\\net1?\.exe$/i
| CommandLine=/\buser\b.*\/add/i
   or CommandLine=/localgroup\s+(administrators|administradores)\s+.*\/add/i
   or CommandLine=/group\s+"?domain admins"?\s+.*\/add/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Looks for: a .sys driver dropped into a user-writable/temp path by a non-system process. Accomplishes: surfaces the BYOVD priv-esc step (T1068) the joint advisory attributes to INC.

// HUNT: Vulnerable driver written to user-writable path (BYOVD)
// MITRE: T1068, T1543.003 | CONF: medium  FP: medium  COST: medium
// REQUIRES: NewExecutableWritten or PeFileWritten
// TUNING: exclude trusted installer parents; cross-ref MS vulnerable driver blocklist
#event_simpleName=/NewExecutableWritten|PeFileWritten/
| TargetFileName=/\.sys$/i
| TargetFileName=/\\(users|temp|programdata|windows\\temp|appdata)\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], sortby=@timestamp, order=desc, limit=200)

Looks for: SystemSettingsAdminFlows.exe disabling Defender, plus PowerShell/reg Defender-disable patterns. Accomplishes: catches the documented INC defense-evasion LOLBin (T1562.001).

// HUNT: Defender disabled via SystemSettingsAdminFlows / tamper
// MITRE: T1562.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with command line
// TUNING: alert directly; exclude documented EDR-migration maintenance windows
#event_simpleName=ProcessRollup2
| (ImageFileName=/\\SystemSettingsAdminFlows\.exe$/i AND CommandLine=/Defender/i)
   or CommandLine=/Set-MpPreference\s+.*-DisableRealtimeMonitoring\s+\$?true/i
   or CommandLine=/DisableAntiSpyware.*(\/t\s+REG_DWORD.*\/d\s+1|=\s*1)/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Looks for: a process named winupd/win.exe running from a system root as a service, or PsExec service-install behavior. Accomplishes: the highest-fidelity INC signature (T1036.005 + T1569.002) — promote to IOA.

// HUNT: PsExec renamed winupd / encryptor launched as SYSTEM service
// MITRE: T1036.005, T1569.002, T1486 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with parent + command line
// TUNING: confirm signer; legit Windows Update does not run %SystemRoot%\winupd.exe
#event_simpleName=ProcessRollup2
| (ImageFileName=/\\(winupd|win)\.exe$/i AND ImageFileName=/\\(windows|system32|temp)\\/i)
   or (ParentBaseFileName=/services\.exe$/i AND ImageFileName=/\\winupd\.exe$/i)
   or CommandLine=/\\winupd\.exe.*(-accepteula|\\\\)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData], sortby=@timestamp, order=desc, limit=200)

Looks for: esentutl copying NTDS.dit and lsassy/comsvcs LSASS dump patterns. Accomplishes: detects the credential-access step (T1003) enabling lateral movement.

// HUNT: Credential dumping (NTDS via esentutl / LSASS dump)
// MITRE: T1003.001, T1003.003 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with command line
// TUNING: scope esentutl to ntds.dit / shadow-copy paths; exclude EDR/backup vendors
#event_simpleName=ProcessRollup2
| (ImageFileName=/\\esentutl\.exe$/i AND CommandLine=/(ntds\.dit|HarddiskVolumeShadowCopy)/i)
   or CommandLine=/lsassy/i
   or CommandLine=/comsvcs\.dll.*MiniDump/i
   or CommandLine=/\\lsass\.exe.*\.dmp/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Looks for: a single source IP/account producing RemoteInteractive logons to an unusually high number of distinct hosts. Accomplishes: surfaces RDP spread (T1021.001) characteristic of the INC hands-on phase.

// HUNT: RDP fan-out from a single source
// MITRE: T1021.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: UserLogon events with LogonType
// TUNING: exclude known jump-host source IPs; tune distinct-host threshold
#event_simpleName=UserLogon
| LogonType=10
| groupBy([UserName, RemoteAddressIP4], function=[count(as=logons), count(field=ComputerName, distinct=true, as=distinctHosts), collect(ComputerName, limit=25)])
| distinctHosts >= 5
| sort(distinctHosts, order=desc)

Looks for: 7-Zip/WinRAR command lines with recursion + archive creation against share/UNC paths. Accomplishes: detects pre-exfil collection/staging (T1560.001).

// HUNT: Archive staging with recursion against shares
// MITRE: T1560.001, T1074 | CONF: medium  FP: medium-high  COST: low
// REQUIRES: ProcessRollup2 with command line
// TUNING: require recursion + UNC/share path; exclude backup/log service accounts
#event_simpleName=ProcessRollup2
| ImageFileName=/\\(7z|7za|7zg|rar|winrar)\.exe$/i
| CommandLine=/\ba\b/i
| CommandLine=/(-r\b|-recurse|\\\\[a-z0-9._-]+\\)/i
| !in(field=UserName, values=["svc-backup","svc-logrotate"])
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Looks for: Rclone copy/sync flags and MegaSync execution — the INC exfil channel. Accomplishes: detects exfiltration (T1567.002/T1537), the last chance before extortion leverage is set.

// HUNT: Cloud exfiltration via Rclone / MegaSync
// MITRE: T1567.002, T1537 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with command line (corroborate with NetworkConnectIP4/DnsRequest)
// TUNING: exclude approved backup hosts and business MEGA accounts; focus on servers
#event_simpleName=ProcessRollup2
| ImageFileName=/\\(rclone|megasync|megasyncsetup64|filezilla|winscp)\.exe$/i
   or CommandLine=/rclone\s+(copy|sync|move|copyto).*:/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], sortby=@timestamp, order=desc, limit=200)

Surface: Windows endpoints · Authority: M1040, M1045, M1043

# PowerShell, run elevated. PILOT RING FIRST -- steps 1 and 2 both need a reboot and
# both can break things: HVCI on an incompatible legacy driver can block boot, and
# RunAsPPL breaks LSASS-hooking SSO agents and legacy AV plugins (look for Event ID 3033).

# 1. Microsoft Vulnerable Driver Blocklist -- breaks BYOVD.
#    NOTE: this is NOT HVCI. The two are independent; the blocklist works on its own.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# 2. LSA Protection (RunAsPPL) -- blunts LSASS dumping.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

# 3. Defender Tamper Protection is NOT settable from here. When it is on, Set-MpPreference
#    calls that alter protection settings are blocked by design -- the lines that used to
#    be here (-DisableTamperProtection / -DisableRealtimeMonitoring) were decorative at
#    best and threw access-denied at worst. Set it in Intune / the Defender portal, then
#    confirm locally:
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled, AMRunningMode

# 4. Verify (after reboot)
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL
reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable

# Rollback (then reboot):
#   reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 0 /f
#   reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
#   If an SSO/AV agent breaks under RunAsPPL, roll that value back first -- it is the
#   likelier culprit and does not require touching code integrity.

Surface: Windows endpoints · Authority: M1042, M1033

# Deny-list unsanctioned remote-access / exfil tooling via AppLocker (publisher + path).
# GPO: Computer Config > Windows Settings > Security Settings > Application Control Policies > AppLocker
# Targets: rclone.exe, megasync*.exe, anydesk.exe (if unsanctioned), winscp.exe, filezilla.exe

Set-AppLockerPolicy -XmlPolicy .\inc_denylist.xml -Merge
# Validate in AUDIT mode for 1-2 weeks before enforce:
Get-AppLockerPolicy -Effective -Xml

# NGFW: block outbound to mega.nz / mega.io and known RMM C2 from server VLANs

Surface: Falcon · Authority: validation

// Confirm winupd-as-service and Defender-disable behaviors are absent post-hardening
#event_simpleName=ProcessRollup2
| (ImageFileName=/\\winupd\.exe$/i AND ParentBaseFileName=/services\.exe$/i)
   or (ImageFileName=/\\SystemSettingsAdminFlows\.exe$/i AND CommandLine=/Defender/i)
| groupBy([ComputerName, ImageFileName], function=count())
// Expect zero rows after PB1/PB2 + IOA promotion