Ransomware crews do their loudest work in the hours before they encrypt anything, and that noise is the strongest warning a defender will get. Before LockBit, the ransomware-as-a-service (RaaS) strain behind thousands of attacks, encrypts a single file, it deletes local backups and pushes its payload across the domain, a sequence documented in a joint CISA advisory. Detection engineering targets exactly that preparation, because the steps that guarantee an unrecoverable payout are the same steps that expose the operator early.
What LockBit Does Before It Encrypts
LockBit’s operators spend days inside a network before the encryption stage of the ransomware kill chain, moving laterally with tools like Cobalt Strike and harvesting credentials. The final hour follows a script. They destroy the Volume Shadow Copy Service (VSS) snapshots that Windows uses to roll a machine back. They stop the backup and database services that hold files open, then deploy the malware to every endpoint at once. MITRE ATT&CK, the adversary-tradecraft knowledge base, catalogs the recovery destruction as T1490, Inhibit System Recovery.
Each of those actions is a detection opportunity. The encryption itself is fast, silent, and effectively irreversible; the preparation is slow, noisy, and native to Windows administration. A defender who waits for file entropy to spike is measuring the damage, not preventing it.
Why Shadow Copy Deletion Beats Encryption as an Alert
The reason this window exists is economic. Ransomware only pays when the victim cannot restore from backups and cannot quietly clean up one machine, so the operator has to destroy recovery and hit the whole estate at once. Those requirements force behavior that is both mandatory for the attacker and rare in normal operations, and that intersection is what detection engineering is built to exploit.
A production system almost never runs vssadmin.exe to delete every shadow copy, stops its own backup agent, and registers an identical scheduled task on 400 hosts inside five minutes. Encryption, by contrast, looks like ordinary file writes until the entropy math gives it away, and by then the keys are gone. The operationally consequential read is that operators count on you watching for the encryption, while their real effort goes into the cleanup that makes it unrecoverable. That cleanup is where your lead time lives.
Four Detection Engineering Moves That Fire Before the Payload Runs
Order these by how much lead time each one buys you, from the earliest staging to the final seconds before encryption.
Catch exfiltration staging before the leak – Alert on large archive creation with 7-Zip or rclone and bulk outbound transfers to cloud storage days before any encryption. This double-extortion staging, the same shift toward prioritizing exfiltration over encryption, is your earliest and highest-value warning.
Detect payload deployment through Group Policy – Watch SYSVOL for new or modified ScheduledTasks.xml under a Group Policy Object. Alert on Windows Event ID 4698 firing near-simultaneously across many hosts, and on directory-change events 5136 and 5137 on Group Policy Containers. LockBit’s self-spread abuses T1484.001, Group Policy Modification, so one GPO writing a task to the whole estate is high signal.
Flag mass service and defense termination – Fire on bursts of net stop, Stop-Service, and taskkill hitting backup, database, and endpoint detection and response (EDR) services within seconds. Watch too for driver loads consistent with a bring-your-own-vulnerable-driver technique, which abuses a signed but vulnerable driver to switch off protection from the kernel. MITRE tracks the tactic as T1489, Service Stop.
Alert on Volume Shadow Copy deletion and boot-recovery sabotage – Trigger on vssadmin.exe delete shadows /all, wmic shadowcopy delete, and bcdedit edits that disable recovery. Pair the command-line rule with a VSS API watch, because some families call the service directly and never spawn vssadmin, defeating any process-name-only rule.
None of these signals require catching the encryption itself, and that is the point of detection engineering against ransomware: you build for the work the operator cannot skip. Each one fires while LockBit is still deleting shadow copies and pushing its payload across the domain, in the window before the first file turns to ciphertext.
Join our LinkedIn group Information Security Community!
