How to detect ransomware lateral spread

In this page

Threat snapshot

The difference between ransomware that encrypts one machine and ransomware that encrypts an entire domain comes down to one phase: lateral movement. An attacker with a foothold on a single endpoint becomes catastrophically more dangerous the moment they begin spreading the encryptor to other hosts. And in domain-joined Windows environments, where a single set of domain admin credentials authenticates to every machine, the tools needed for that spread, PsExec, admin shares, WMI, are already present on every host.

Lateral spread detection is where SIEM coverage has an outsized return. By the time encryption begins, the damage on any individual host is already happening. But catching the spread phase while it is in progress, while the encryptor binary is being distributed but before execution has started on the remote hosts, leaves a window to isolate and prevent. That window may be minutes rather than hours, but it is there.

Log360 maps 53 detection rules to ransomware lateral spread behavior across T1021 (Remote Services), T1570 (Lateral Tool Transfer), and T1047 (Windows Management Instrumentation). The coverage spans PsExec service installation patterns, admin share file copy activity, WMI remote execution, and the account behavior anomalies that accompany credential-driven lateral movement across domain-joined hosts.

Ransomware lateral spread, at a glance

Severity Critical
Category Ransomware & Extortion
MITRE ATT&CK tactic TA0008 Lateral Movement
MITRE techniques T1021 Remote Services, T1570 Lateral Tool Transfer, T1047 Windows Management Instrumentation
Sub-techniques covered T1021.002 SMB/Windows Admin Shares, T1021.001 RDP, T1021.006 Windows Remote Management
Platforms covered Windows, Active Directory
Log360 detection rules 53 rules
SOC maturity level Level 3 - Incident Response
Compliance mapping NIST CSF DE.CM-1, PCI-DSS 11.5, HIPAA Section 164.312(b), ISO 27001 A.12.4.1

How ransomware lateral spread works

Ransomware lateral spread follows the same techniques used in any post-exploitation lateral movement scenario, adapted for maximum speed and coverage across the target environment. The goal is to reach every valuable host before the encryption phase begins, ensuring maximum ransom leverage.

PsExec and service-based remote execution

PsExec is the most commonly documented tool for ransomware lateral spread in enterprise environments. It works by copying an executable (PSEXESVC.exe) to the target host's ADMIN$ share and then creating and starting a Windows service to execute it. This generates a highly specific sequence of events: a file write to the admin share (Event 5140), followed by a new service installation (Event 7045 for PSEXESVC), followed by service start (Event 7036). The speed at which this sequence appears across many hosts simultaneously is the primary signal that distinguishes ransomware deployment from legitimate administrative use of PsExec.

Admin share file copy and remote execution

Beyond PsExec, ransomware operators copy their encryptor binary to remote admin shares using standard Windows file copy commands (copy, xcopy, robocopy) and then execute it remotely using schtasks, sc, or WMI. The file copy generates Event 5140 (network share access) and Event 4663 (file written to share) on the target host. Remote scheduled task creation generates Event 4698 on the target. Remote service creation generates Event 7045. Each of these events in isolation is not unusual, but their appearance in combination across many hosts in a short window is the ransomware spread signature.

WMI remote execution

Windows Management Instrumentation provides a legitimate remote execution capability that ransomware operators use as an alternative to PsExec. WMI-based remote execution uses Win32_Process.Create to launch a process on a remote host without requiring a service installation. This leaves a lighter footprint than PsExec but still generates Microsoft-Windows-WMI-Activity event log entries and process creation events on the target host showing wmiprvse.exe as the parent process. A process launched with wmiprvse.exe as parent in the context of a ransomware incident is the WMI remote execution signal.

Credential-driven movement across domain-joined hosts

All of the above lateral movement techniques require credentials. Ransomware operators who have obtained domain admin credentials, typically through LSASS dumping or NTDS extraction, can authenticate to every domain-joined host without any further exploitation. The authentication events appear as Event 4624 Type 3 (network logon) from an account that does not normally access the target host, or which accesses an unusual number of hosts in a short window. This account behavior anomaly is one of the earliest lateral movement signals and may appear before any file copy or service installation events.

Real-world campaigns

LockBit: automated spread via PsExec and Group Policy

LockBit affiliates have been documented using both PsExec-based spread and Group Policy modification to distribute the encryptor across domain-joined hosts. The Group Policy approach modifies an existing GPO or creates a new one that runs the encryptor on logon or startup, reaching hosts that may not be reachable via direct admin share access. This generates Event 5136 (directory service object modified) on the domain controller for the GPO change, followed by Event 4688 on each host that processes the modified GPO.

Ryuk: targeted spread after extended reconnaissance

Ryuk operators spend more time than most ransomware affiliates on pre-spread reconnaissance, identifying the specific hosts that host high-value data (file servers, database servers, backup infrastructure) before beginning lateral movement. The spread phase is more targeted and slower, which means the per-host event pattern may not immediately reach anomaly thresholds. However, the use of compromised domain admin credentials to access an unusual set of hosts in a sequence still generates the Type 3 logon anomaly signal that Log360 correlates.

BlackSuit and RansomHub: living-off-the-land spread without PsExec

Newer ransomware affiliates have moved away from PsExec specifically, using built-in Windows tools like wmic /node: process call create, schtasks /create /s, and sc \\remotehost create instead. These techniques generate the same underlying events (WMI activity, scheduled task creation, service installation) but do not produce the PSEXESVC binary artifact that some detection rules specifically look for. Log360's coverage of WMI execution and remote service creation catches these living-off-the-land variants.

Business impact

  • Lateral spread determines the total blast radius of the incident: An encryptor contained to one host is an operational inconvenience. An encryptor that has reached 200 domain-joined hosts before encryption begins is a business-stopping event. The entire cost difference between a contained incident and a full domain compromise is determined by whether lateral spread is caught in time.
  • File servers and domain controllers are the highest-priority targets: Ransomware operators specifically route their spread toward file servers (for maximum data encryption) and domain controllers (for maximum persistence and the ability to re-encrypt after partial recovery). Detection of lateral movement toward these assets should trigger the highest-priority response.
  • The encryption phase can begin automatically after spread completes: Many modern ransomware deployments trigger encryption automatically after the encryptor binary has been distributed, with a short scheduled delay. This means the window between lateral spread completion and encryption onset may be minutes.

Detecting ransomware lateral spread with Log360

The rules below cover the primary lateral spread vectors. Effective detection requires Windows Security audit logging for Logon/Logoff (Event 4624), Object Access for file shares (Event 5140), and System events (Event 7045 for service installation). WMI activity logging should also be enabled via Microsoft-Windows-WMI-Activity/Operational on all monitored hosts.

Rule name Severity Platform MITRE technique What it detects
Copy From Or To Admin Share Or Sysvol Folder Trouble Windows T1021.002 File copy operations to or from admin shares (C$, ADMIN$, SYSVOL), the primary method used to distribute ransomware binaries to remote hosts. In a ransomware spread context, this rule fires as the encryptor is copied to each target host's ADMIN$ share before remote execution.
HackTool - Wmiexec Default Powershell Command Trouble Windows T1047 Wmiexec tool's default PowerShell command pattern, used for WMI-based remote execution without the PsExec service installation footprint. Wmiexec is used by several ransomware affiliates as their primary lateral movement tool.
Potential SMB Relay Attack Tool Execution Critical Windows T1557.001 Execution artifacts from SMB relay attack tools, which ransomware operators use to capture and relay NTLM credentials from hosts in the environment, converting a non-privileged foothold into domain admin access for lateral movement.
Hijack Legit RDP Session to Move Laterally Trouble Windows T1219.002 tscon-based hijacking of existing RDP sessions, used to take over authenticated sessions on remote hosts without requiring the original user's credentials. Particularly relevant in environments where domain admins leave active RDP sessions.
Office Executable File Uploaded Trouble Microsoft 365 T1570 Executable file uploaded to a Microsoft 365 SharePoint or Teams channel, a technique used by some ransomware operators to distribute tooling or the encryptor binary through trusted cloud storage rather than direct admin share access.
HackTool - Impersonate Execution Trouble Windows T1134.001 Execution of token impersonation tools, used to acquire the security context of a higher-privileged account on a host where a domain admin has an active session, enabling lateral movement without credential dumping.
HackTool - SharpImpersonation Execution Trouble Windows T1134.001 SharpImpersonation-specific execution artifacts, a .NET-based token impersonation tool used by ransomware affiliates and red teamers to acquire privileged tokens for lateral movement without triggering credential dumping alerts.
Disable Administrative Share Creation at Startup Trouble Windows T1070.005 Modification of registry settings to disable admin share creation, used during post-infection cleanup to remove the lateral movement path after the encryptor has been distributed, complicating forensic reconstruction.
Remote Access Tool - ScreenConnect Execution Trouble Windows T1219.002 ScreenConnect remote access tool execution, commonly deployed by ransomware operators after initial access to establish persistent remote access before lateral movement begins.
Remote Access Tool - AnyDesk Execution Trouble Windows T1219.002 AnyDesk execution, used by some ransomware affiliates for interactive remote access during the lateral movement and reconnaissance phase, complementing automated spread tools.

Attack chain visibility

Step Log source and event What it indicates Time offset
1 Windows Event 4624 Type 3 - network logon from compromised domain admin account to multiple hosts Credential-driven lateral movement is beginning. The same account authenticating to an unusual number of hosts in a short window is the first spread signal. No files have been copied yet. T+0
2 Windows Event 5140 - network share access to ADMIN$ on multiple target hosts Encryptor binary being copied to target hosts. Copy From Or To Admin Share Or Sysvol Folder rule fires. Combined with step 1, this confirms active ransomware distribution. T+1 to T+5 min after step 1
3 Windows Event 7045 - new service PSEXESVC installed on target hosts (if PsExec used) Remote execution via PsExec. Service installation events appearing across multiple hosts within minutes confirm automated spread. Each 7045 event represents the encryptor being staged on that host. T+seconds to T+1 min after step 2
4 Microsoft-Windows-WMI-Activity events on target hosts (if WMI used instead of PsExec) WMI-based remote execution triggered. Wmiexec Default Powershell Command rule fires if wmiexec is the tool. Process creation events on target hosts show wmiprvse.exe as parent of the encryptor process. T+alternative to step 3
5 High-velocity file audit events (Event 4663) on target hosts - mass file modifications Active encryption begins on distributed hosts. Depending on the deployment delay, this may begin almost simultaneously across all hosts that received the binary. T+minutes to T+hours after step 3 or 4

Investigation playbook

Step 1: Identify the spreading account and its reach

  • Query Log360 for Event 4624 Type 3 logons from the account associated with the lateral movement alert across all domain hosts for the prior 4 hours. Generate a list of every host that account has authenticated to. This is the potential blast radius of the spread.
  • Verify whether the account is a domain admin or has equivalent privileges. If it is, every domain-joined host is a potential target. If it is a local admin account, scope the search to the hosts in the same local network segment.
  • Check the Log360 alert history for credential dumping alerts (Mimikatz, LSASS access) on the initial foothold host in the hours preceding the lateral movement alerts. The credential dumping event establishes when the attacker obtained the credentials used for spread.

Step 2: Identify which hosts have already received the encryptor binary

  • Query Event 5140 (share access) and Event 4663 (file write) events on all hosts in the potential blast radius for file writes to ADMIN$ or C$ shares from the spreading account. Hosts where a file write occurred to these shares are likely to have the encryptor binary already present.
  • Query Event 7045 (service installation) across all hosts for the lateral movement window. Hosts with a new service installed by the spreading account in this window should be treated as having the encryptor deployed and ready to execute.
  • Prioritize hosts with Event 7045 for immediate isolation, as service installation typically means the encryptor is already executing or is about to execute.

Step 3: Contain in order of risk

  • Isolate the domain controller first if the spreading account is a domain admin. Domain controller isolation prevents the spread credentials from being used to reach additional hosts, even though it will disrupt authentication for legitimate users. This disruption is preferable to additional hosts being encrypted.
  • Isolate file servers and database servers as the next priority. These hosts host the highest-value data and their encryption causes the most recovery complexity.
  • Work outward through the confirmed blast radius list, isolating hosts in order of value and confirmed encryptor presence.

Response and remediation

Immediate actions

  • Revoke the spreading account's credentials immediately: Force a password reset and kill all active sessions for the compromised account. If the account is a domain admin, perform a full Tier-0 credential reset including a double krbtgt reset to invalidate all Kerberos tickets issued with the current krbtgt key.
  • Block the spreading account at the domain level: Disable the account in Active Directory immediately. This stops new authentications even if existing sessions remain active on already-compromised hosts.
  • Do not attempt to clean infected hosts before isolating them: Running cleanup tools on a host that is still network-connected may trigger additional destructive payloads or push the attacker to accelerate their timeline.

False positive tuning

False positive source Rules affected Tuning strategy
IT deployment tools (SCCM, Ansible, PDQ) using admin shares Copy From Or To Admin Share Or Sysvol Folder Allowlist the specific service accounts and source hosts used by deployment tools. Tune alerts to fire only when the source account does not match the deployment tool allowlist or when the destination host count exceeds the normal deployment batch size for that tool.
Legitimate WMI-based management and monitoring HackTool - Wmiexec Default Powershell Command The Wmiexec rule targets a specific tool's default command pattern rather than generic WMI use. Legitimate WMI management tools do not generate this specific pattern. This rule has a low false positive rate and should not be broadly suppressed.
Remote access tools used by IT helpdesk Remote Access Tool - ScreenConnect Execution, Remote Access Tool - AnyDesk Execution Allowlist the specific helpdesk service accounts and approved remote access tool installation paths. Alert on any remote access tool execution from a non-allowlisted account or from an installation path that does not match the standard helpdesk deployment path.