Use Case: Endpoint
Ransomware early warning
Volume Shadow Copies deleted at 11:47 PM. Encryption doesn't start for 13 more minutes. That window is your entire containment opportunity. ManySignal fires a P1 alert in the first 60 seconds.
The 22-hour dwell that you have 13 minutes to stop
Modern ransomware operators dwell for days or weeks before encrypting. They use the access to identify the most valuable data, map out the backup infrastructure, and ensure maximum blast radius. The encryption event itself is the last step — and by then, the damage is done unless you can detect and contain in minutes.
The pre-encryption phase has consistent forensic signatures: Volume Shadow Copy deletion (to prevent recovery), rapid file rename or extension change (the encryption loop starting), and in some strains, a network scan to identify additional targets before the encryption spreads laterally.
These signals appear in EDR telemetry, Windows Event Logs, and network flow data — but only if someone is watching in real time. ManySignal correlates all three within the 90-second pipeline window.
From phishing to detection
T-0 — Initial Access
Phishing email delivers LNK dropper
T+4h — Credential Access
Cobalt Strike beacon established, LSASS dump via procdump64.exe
T+18h — Lateral Movement
Lateral movement via WMI to domain controller
T+22h — Defense Evasion
Volume Shadow Copy deletion: vssadmin delete shadows /all /quiet
T+22h15m — DETECTED
ManySignal fires P1 alert on VSS deletion + file rename rate
T+23h — Impact (contained)
Encryption begins on file server
rule: ransomware_pre_encryption_signal
type: correlation
sources:
- crowdstrike_falcon
- microsoft_defender_endpoint
- sysmon_event_log
- netflow
trigger:
# Signal A: VSS deletion
- event: process.create
- cmdline_match: ["vssadmin delete shadows", "wmic shadowcopy delete",
"bcdedit /set {default} recoveryenabled No"]
# Signal B: high file rename rate
- event: file.rename_or_write
- rate: > 50 files/sec
- within: 30s
- any_two_signals: true
enrichments:
- process_signer: code_signing_db
- c2_check: recorded_future, threatfox
- blast_radius: network_segment_map
mitre: T1490 (Inhibit System Recovery), T1486 (Data Encrypted for Impact)What the agent answers in the first 2 minutes
Was vssadmin, wmic, or PowerShell used to delete Volume Shadow Copies in the last 10 minutes?
EDR process logWhat is the current file rename rate per second on the affected host?
Endpoint telemetryIs the process making file modifications signed by a known-good publisher?
Code signing DBHas this host communicated with any known ransomware C2 infrastructure?
DNS / NetFlowWhat accounts have active sessions on the affected host right now?
WinEvent / SysmonWhich other hosts share a network segment with the affected host?
Asset inventoryAre backup systems (Veeam, Azure Backup) currently reachable from this host?
Network graphIsolate affected host from network via EDR (CrowdStrike contain / SentinelOne disconnect)
Approve-gatedCapture full memory dump of the suspicious process for forensic analysis
AutonomousSnapshot all file shares the host has write access to before encryption spreads
AutonomousAlert IR lead and CISO via PagerDuty with full evidence package
AutonomousDisable Active Directory accounts with active sessions on the host
Approve-gatedInitiate backup integrity verification to confirm clean restore point exists
RecommendLegacy SOC comparison
The EDR fires an alert for VSS deletion. It's medium severity — vssadmin is used by legitimate backup software too. The alert sits in the queue at 11:47 PM. The on-call analyst is managing another P1. By 12:00 AM, 13 minutes later, encryption has started. By 6 AM when the IR team is assembled, 40% of file servers are encrypted and the backup target is unreachable.
MITRE ATT&CK mapping
Ransomware early warning FAQ
What's the detection window before encryption begins?
VSS deletion and high-speed file rename are pre-encryption behaviors. ManySignal detects both within 30-60 seconds of the events occurring. Most ransomware strains begin encryption 5-15 minutes after VSS deletion, giving the team a meaningful containment window.
Does this work for ransomware that doesn't delete VSS copies?
Yes. ManySignal uses a multi-signal model: VSS deletion is one trigger. Independent signals include rapid file extension changes, abnormal entropy in written files, known ransomware process names, and C2 communication patterns. Any two signals in combination triggers the alert.
Can ManySignal contain ransomware without human approval?
Network isolation and memory capture are available as autonomous actions. Account disablement requires analyst approval by default. Both thresholds are configurable — organizations that have pre-authorized isolation for confirmed ransomware indicators can make containment fully autonomous.
Which EDR platforms does ManySignal use for the endpoint signals?
CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black EDR, and Palo Alto Cortex XDR. ManySignal also ingests Sysmon logs for organizations without a commercial EDR.
Does ManySignal detect double-extortion ransomware (encrypt + exfil)?
Yes. Exfiltration before encryption leaves a separate signal: large file transfers to external IPs, cloud storage uploads, or rclone/restic activity. ManySignal correlates the data movement signal with the pre-encryption signals to identify double-extortion campaigns and escalate accordingly.
Close the 13-minute window before encryption begins
Ransomware pre-encryption signals correlated across EDR, Windows events, and network flow. See it working against your telemetry.