CISA's ransomware checklist lists behaviours that show up in an enterprise before encryption: new privileged accounts, odd VPN logins, tampering with backups and shadow copies, credential dumping, unexpected remote management tools, and outbound data transfers. Searching for these gives you a chance to act in the quiet stage.
Accounts and logins
- New Active Directory accounts, escalated privileges, or unusual activity on privileged accounts such as Domain Admins.
- Anomalous VPN or other suspicious logins.
Tampering with recovery
CISA says to look for endpoint changes that impair backups, shadow copies, journaling or boot configuration, including misuse of bcdedit.exe, fsutil.exe, vssadmin.exe, wbadmin.exe and wmic.exe. These are legitimate tools, so look at who ran them, from where and when.
Attacker tooling
- Signs of Cobalt Strike, which attackers often disguise with legitimate Windows process names.
- Unexpected remote monitoring and management software, including portable executables that were run and removed.
- Unexpected PowerShell or PsTools use.
- New services, unexpected scheduled tasks or unexpected software.
Credential and directory discovery
- Active Directory enumeration.
- LSASS or credential dumping, for example with Mimikatz or NTDSutil.exe.
- Unexpected endpoint to endpoint communication, which can mean lateral movement.
Possible data theft
- Abnormal outbound data on any port.
- Tunnelling tools; CISA names Chisel and Cloudflared.
- Transfer tools such as Rclone and Rsync, web file storage services, and FTP or SFTP.
Turning the list into a routine
A list helps only if someone runs it. Try this:
- Pick five items that your logging can already answer, such as new privileged accounts and backup tool use.
- Write the query once, with the data source named.
- Run it weekly and record what you found, including "nothing".
- Add an alert when a result is clearly bad, such as shadow copy deletion on a server.
- Fill gaps in logging. CISA recommends centralising logs and keeping them at least a year where possible.
Cloud environments
CISA's cloud advice is to detect and prevent changes to identity, network security and data protection resources, and to automate responses, such as disabling a newly created rule that opens traffic to 0.0.0.0/0 and notifying the creator and the security team.
Common mistakes
- Hunting only on servers while the first foothold was a laptop.
- Alerting on admin tools without context, which buries the real signal in noise.
- Keeping logs for too short a period to look back.
- Finding something and quietly fixing it, without treating it as an incident.
Quick check
Will these signs always mean ransomware?
No. Several are legitimate admin activity. The value is in unexpected use, by the wrong account, on the wrong host, at the wrong time.
What if we find one?
Follow your incident response plan, preserve evidence and isolate where needed. Treat precursor findings as an incident, not a ticket.
Sources
Last reviewed: 19 October 2026.
