Intermediate 10 min read

The Ransomware Kill Chain, Stage by Stage

Walk a full ransomware intrusion, phishing to domain-wide encryption, with the ATT&CK technique and the detection opportunity at each stage.

Initial AccessExecutionPriv EscCredential AccessLateral MovementImpact

Ransomware rarely detonates the instant it lands. It moves through a chain of stages, and each one is a chance to detect and contain before impact. Here is the flagship chain Tyrian runs, mapped to ATT&CK.

T1566.001Spearphishing Attachment
A macro-enabled document lands in an inbox and spawns a PowerShell stager on the workstation.
T1059.001PowerShell execution
The stager pulls an implant from a redirector and establishes an HTTPS C2 beacon.
T1055Process Injection
The implant injects into a trusted process to hide. Sysmon EID 8 is your telemetry here.
T1548.002UAC bypass
An auto-elevating binary escalates to local administrator.
T1003.001LSASS dumping
Credentials are harvested from LSASS memory, high-fidelity detection opportunity.
T1021.002SMB / PsExec lateral movement
Stolen credentials reach the domain controller over admin shares, the gap most SOCs miss.
T1486Data Encrypted for Impact
Files are encrypted domain-wide and a ransom note is dropped. Mass file modification is the last-ditch trigger.

The earlier you detect, the cheaper the incident. Catching the C2 beacon or the LSASS dump ends the story before impact, but only if you've actually exercised those detections.

Stop reading. Start detecting.

Try the interactive kill chain in your browser, no signup, then run the real range.

Run it live, free

Next module

Detection Engineering 101

→