Encryption is the last step of a ransomware operation, and by then the response options have collapsed. The stages before it generate network traffic for days or weeks, and every hop, probe, and staged gigabyte lands in flow records. This page walks through the ransomware kill chain as the network sees it, the specific signatures worth alerting on, threshold starting points, and the honest limits of network-side detection.
In this guide:
- The ransomware kill chain, stage by stage, as it appears in flow data.
- Lateral movement and exfiltration signatures, with alert threshold starting points.
- What flow monitoring will not catch, and how to layer defenses accordingly.
Why the network sees ransomware before the ransom note
Ransomware operators rarely encrypt on arrival. Incident response reporting, including Mandiant's annual M-Trends research, has repeatedly measured meaningful dwell time between initial compromise and ransomware deployment, time the operator spends mapping the network, hopping toward high-value systems, and staging data for double extortion. All of that activity crosses the network. Flow monitoring converts the operator's preparation window into the defender's detection window, when isolating two machines still contains the incident.
The ransomware kill chain in flow data
| Stage | Attacker activity | Flow-data signature | ATT&CK tactic |
|---|---|---|---|
| Initial access | Phishing payload, exposed service, purchased access | New outbound connection from patient zero to unfamiliar infrastructure | Initial Access (TA0001) |
| Command and control | Implant checks in for instructions | Regular-interval beaconing to a fixed external destination | Command and Control (TA0011) |
| Discovery | Mapping hosts, shares, and directory services | Internal fan-out: one host probing many addresses, LDAP and Kerberos chatter rising | Discovery (TA0007) |
| Lateral movement | Hopping toward domain controllers and backups | SMB 445 and RDP 3389 chains between hosts that rarely communicate | Lateral Movement (TA0008) |
| Staging and exfiltration | Collecting and uploading data for double extortion | Large internal transfers to a staging host, then heavy outbound volume to new destinations | Exfiltration (TA0010) |
| Encryption | Deployment and execution | Traffic largely goes quiet; the network signal precedes this stage | Impact (TA0040) |
Read the table bottom to top and the lesson is plain: every stage above encryption is loud on the network. The goal of monitoring is to make any one stage sufficient for detection.
Lateral movement signatures
Windows environments give ransomware operators a small set of roads between machines, and each road has a port number.
- SMB fan-out: TCP 445 connections spreading from a single workstation, especially toward administrative shares (ATT&CK T1021.002).
- RDP chains: Host A connects to host B on TCP 3389, and B shortly afterward connects to C, forming hop sequences no help desk produced.
- WinRM from odd sources: 5985 and 5986 traffic from machines with no administration role.
Context multiplies the signal. A domain controller receiving SMB connections from workstations is Tuesday. A workstation receiving SMB connections from another workstation deserves a look. Flow data carries the direction, the initiator, and the history to tell these apart.
Exfiltration before encryption
Modern ransomware operations steal data before encrypting it, so the ransom carries a leak threat alongside the recovery threat. The stage produces two visible movements. First, internal collection: unusually large transfers from file servers toward a single internal host acting as the staging point. Second, the outbound push: sustained high-volume flows from that staging host to external destinations, frequently unsanctioned cloud storage, frequently at night.
Both movements deviate hard from baseline. File servers have predictable clients, and workstations have predictable upload volumes. The staging pattern breaks both predictions at once, which makes it one of the highest-confidence detections available.
Alert thresholds that catch movement early
Concrete starting points, each tuned against your own baselines:
- Internal fan-out: Alert when any host initiates connections to more than 30 distinct internal addresses within 10 minutes. Exempt vulnerability scanners and patch systems by IP group.
- East-west SMB and RDP: Alert on workstation-to-workstation flows on 445 or 3389, with a tighter variant for any host contacting more than a handful of distinct peers on these ports within an hour.
- Staging collection: Alert when transfers from file servers to any single internal host exceed a multiple of that pair's historical volume.
- Outbound push: Alert on outbound volume beyond the sending host's daily baseline multiple, weighted higher outside business hours and toward first-seen destinations.
- Beacon persistence: Alert on regular-interval outbound connections sustained past a few hours to destinations off your known-services list.
The numbers are deliberately conservative openers. Tighten them as baselines mature. The objective is an alert during movement, when containment is a two-machine problem, instead of during encryption, when it is a network-wide one.
What flow monitoring will not catch
Honesty makes detection programs better. Flow data does not see payloads, so it cannot identify the malware family, read the phishing attachment, or inspect an encrypted channel's contents. Purely host-local activity, such as privilege escalation on one machine or encryption of local files, generates no flows. Fast-moving ransomware in a flat network compresses the detection window that flow monitoring depends on.
The practical conclusion is layering. Endpoint detection and response covers the host interior. Flow monitoring covers the space between hosts, which EDR does not see and attackers cannot avoid crossing. Tested backups, segmentation, and a rehearsed response plan cover the failure modes of both.
Ransomware detection with ManageEngine NetFlow Analyzer
ManageEngine NetFlow Analyzer turns flow export from your existing routers, switches, and firewalls into the detections above, with no agents and no capture hardware.
Feature highlights:
- East-west baselines: Per-group profiles of internal traffic, the reference every rule depends on.
- Threshold and behavior alerting: Fan-out, port-specific, and volume-deviation rules with severity mapping.
- Escalation-ready workflows: Alarms routed to ticketing and chat with the urgency ransomware imposes.
- Timeline forensics: Retained flow records reconstruct the intrusion path for recovery and disclosure decisions.
FAQs on ransomware detection
How early can network monitoring detect ransomware?
At the first internal movement, which incident response reporting consistently places days before encryption. Discovery scans, lateral SMB and RDP hops, and staging transfers all generate detectable flow anomalies during the operator's preparation phase, while containment remains a two-machine problem.
What ports does ransomware lateral movement use?
Can ransomware be detected in encrypted traffic?
Does flow monitoring replace EDR for ransomware?
What flow retention supports ransomware investigations?
Catch ransomware lateral movement before if affects your users.
Start your 30-day free trial
By Shynu,
ManageEngine Team