By the time files start getting encrypted, it is too late. The good news: ransomware is not a single instantaneous event — it is a multi-stage operation that generates detectable signals at every step before the payload fires. A properly configured SIEM can catch those signals and let you intervene while there is still time. This guide walks through the attack stages and the specific detection rules that catch them.
Modern ransomware operators do not just drop a payload and encrypt. They follow a predictable sequence: gain initial access, establish persistence, escalate privileges, move laterally to reach as many systems as possible, exfiltrate data for double-extortion, and only then deploy encryption across the environment. This sequence often unfolds over days or even weeks — a long window in which a SIEM has many chances to detect the intrusion.
The core insight
Encryption is the last stage, not the first. Every stage before it — access, persistence, escalation, lateral movement, staging — leaves log evidence. Detection is about catching the earlier stages, not the encryption itself.
Most commonly via phishing, exposed remote access services, or exploitation of an unpatched internet-facing system. SIEM signals: successful logins from unusual geographies, authentication to remote access services outside business hours, new external connections to internal services, or email gateway logs showing a malicious attachment that was opened.
Attackers establish a foothold that survives reboots and work toward administrative rights. SIEM signals: new scheduled tasks or services created, new accounts added to privileged groups, unusual registry modifications, and a standard user account suddenly performing administrative actions.
The attacker spreads from the initial host to reach domain controllers, file servers, and backup systems. SIEM signals: a single account authenticating to an unusually large number of hosts in a short window, use of remote execution tools across systems, and internal traffic patterns that deviate sharply from baseline.
Modern ransomware steals data before encrypting it (double extortion). SIEM signals: large internal file transfers consolidating data onto one host, then large outbound transfers to external destinations or cloud storage that the organisation does not normally use.
Immediately before encryption, operators try to disable recovery. SIEM signals: commands that delete volume shadow copies, attempts to stop backup services, security tool tampering, and mass deletion of backup files. This is the highest-priority signal — it almost always immediately precedes encryption.
The payload executes across the environment. SIEM signals: a single process opening, modifying, and renaming files at extremely high rates; mass file extension changes; ransom note files appearing across many directories simultaneously.
You cannot watch every stage with equal attention. These are the highest-value ransomware detection rules to prioritise in your SIEM, roughly in order of how reliably they indicate an active ransomware incident:
Why correlation beats single rules
Any one of these signals alone might be a false positive. The power of a SIEM is correlation: shadow copy deletion AND lateral movement AND a privileged group change within the same hour is not noise — it is an active intrusion in its final stage. nPro maps these to MITRE ATT&CK so the chain is visible as a single incident, not seven disconnected alerts.
Each ransomware stage corresponds to MITRE ATT&CK tactics: Initial Access (TA0001), Persistence (TA0003), Privilege Escalation (TA0004), Lateral Movement (TA0008), Collection and Exfiltration (TA0009/TA0010), Impact (TA0040). A SIEM that aligns detections to ATT&CK lets your analysts see exactly which stage an attack has reached and how far it has progressed — turning a pile of alerts into a coherent kill-chain narrative.
During a ransomware incident, attackers often try to disable or blind security monitoring. If your SIEM logs live only in a cloud service the attacker may have also compromised credentials for, your forensic trail is at risk. A self-hosted SIEM with append-only, tamper-evident log storage preserves the evidence you need for response and recovery even if endpoints are compromised. It also means your incident data — which is highly sensitive during a breach — stays within your control.
If ransomware detection is your priority, configure these in your SIEM first: ingest domain controller and endpoint logs (where the strongest signals live), enable the shadow-copy-deletion and backup-tampering rules as critical-priority alerts, set up lateral movement velocity detection on privileged accounts, and ensure your log retention is long enough to reconstruct the full attack timeline after the fact. For the full deployment walkthrough, see our guide on deploying a self-hosted SIEM on Ubuntu.
nPro ships with MITRE ATT&CK-aligned ransomware detection rules out of the box. Self-hosted, 5-minute deploy.
Related: What is a SIEM? · SIEM vs SOAR · SIEM for Healthcare · nPro SIEM