All posts
Threat researchJune 2026 9 min read

Anatomy of a ransomware kill chain (ATT&CK-mapped)

From a single phishing email to domain-wide encryption, the seven stages of a ransomware intrusion, the ATT&CK technique behind each, and where you get to intervene.

By The Tyrian team

Ransomware feels sudden from the outside, files locked, note dropped. From the inside it's a chain of discrete steps, and every step is a chance to detect and contain before impact. Here's the full chain, mapped to MITRE ATT&CK.

  1. T1566.001Spearphishing Attachment

    A macro document spawns a PowerShell stager. Detection: office apps spawning script hosts.

  2. T1059.001PowerShell / C2 beacon

    The stager fetches an implant and beacons over HTTPS. Detection: encoded commands, anomalous outbound beaconing.

  3. T1055Process Injection

    Code injects into a trusted process. Detection: Sysmon EID 8 CreateRemoteThread correlation.

  4. T1548.002UAC bypass

    An auto-elevating binary escalates to admin. Detection: fodhelper / known bypass binaries.

  5. T1003.001LSASS dumping

    Credentials harvested from memory. Detection: suspicious lsass.exe handle access (Sysmon EID 10).

  6. T1021.002SMB / PsExec

    Movement to the domain controller over admin shares. Detection: remote service creation, the common gap.

  7. T1486Data Encrypted for Impact

    Domain-wide encryption and a ransom note. Detection: mass file modification volume.

The lesson

There are at least six detection opportunities before impact. An organization that catches the C2 beacon or the LSASS dump never reaches encryption. The question is never 'do we know about these techniques', it's 'have we exercised the detections, and how fast do they fire.'

This exact chain is Tyrian's flagship scenario. Run it live and you get a per-technique detected/partial/missed score and MTTD, not a feeling that you're covered.

See it on a real range

Run the interactive kill chain free, or create an account and start with $5 of credit.

Try it freeLearn more