---
description: >-
  Blocking ransomware by detecting and stopping harmful commands in LimaCharlie.
  This guide shows how to prevent attackers from deleting backups.
---

# Part 4 - Blocking Ransomware

## **Blocking Attacks in LimaCharlie**

### **Introduction**

In Part 3, we explored crafting detection rules to identify threats in real time. However, detecting threats is only half the battle—blocking them before they cause harm is the next crucial step.

Blocking attacks requires careful **baselining** to avoid false positives. A best practice is to first run a detection rule in alert-only mode, monitor it for a period, eliminate false positives, and then deploy a blocking version.

Here we will create a rule that effectively disrupts a **ransomware attack** by detecting and blocking the deletion of Volume Shadow Copies.

***

### **Why This Rule?**

Volume Shadow Copies allow restoration of files or entire file systems, making them a crucial recovery tool against ransomware. Attackers use this to remove backups before encrypting files.

A common command used for this action:

```shell
vssadmin delete shadows /all
```

This command is rarely executed in a healthy environment, making it a **low false-positive, high-value detection candidate**.

***

### **Detecting Volume Shadow Copy Deletion**

#### **Step 1: Execute the Malicious Command**

1. Open an SSH session to the **Linux VM** and start a **Sliver C2 shell** on the victim.
2.  Run:

    ```shell
    shell
    ```
3.  Confirm when prompted: _“This action is bad OPSEC, are you an adult?”_ → Type `Y` and press Enter.\
    \


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FPoXk3B25U61J1DnoAL73%2Fimage.png?alt=media&#x26;token=8ab244d9-f967-4a77-a3aa-aaf297974c97" alt=""><figcaption></figcaption></figure>
4.  Execute the following:

    ```shell
    vssadmin delete shadows /all


    ```

\
\- The output doesn't matter; whether or not Volume Shadow Copies exist on the VM, running the command is enough to generate the required telemetry.

5. Run:

```shell
whoami
```

This confirms if the session is still active.\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FPXvAzRNP1InRcbEk58ku%2Fimage.png?alt=media&#x26;token=ebc36681-ee5b-44ac-ad07-d6a3fe5da52c" alt=""><figcaption></figcaption></figure>

#### **Step 2: Check for Detection**

1. Open **LimaCharlie’s Detection Tab**.
2.  Look for any Sigma rule detections.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FWORWzv7DiANwqZWgM0jJ%2Fssaa.png?alt=media&#x26;token=9170bfa1-5537-469e-8586-3f01ac8814b4" alt=""><figcaption></figcaption></figure>
3.  Expand the detection to review its metadata. Sigma rules include references that help explain why the detection was triggered.\
    \


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F4FHD1VyTvTVxPGSyHm1O%2Fatt.png?alt=media&#x26;token=38dec268-289f-4ea8-8e1c-9f362f1d4b46" alt=""><figcaption></figcaption></figure>
4.  View the raw event in the **Timeline**.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F8LX1uj2td9e0jMCXJlJY%2Faxxx.png?alt=media&#x26;token=72f31a39-6e5a-4694-a82d-9de838a8d409" alt=""><figcaption></figcaption></figure>

***

### **Crafting the Detection & Response (D\&R) Rule**

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FV7wJEXEvWv556TmqlSfj%2Fds.png?alt=media&#x26;token=68315e1a-e2c3-493c-8a19-c9f2fdaa2582" alt="" width="563"><figcaption></figcaption></figure>

\
Using the detected event, we will create a rule to **detect and terminate** the parent process responsible \
for executing the deletion command.

#### **Response Action**

```yaml
response:
  - action: report
    name: vss_deletion_kill_it
  - action: task
    command:
      - deny_tree
      - <<routing/parent>>
```

* The `action: report` section generates a detection report in the "Detections" tab.
* The `action: task` section uses `deny_tree` to terminate the parent process that executed the `vssadmin delete shadows /all` command.

Save this rule as **vss\_deletion\_kill\_it**.

***

### **Testing the Blocking Rule**

1. Return to the **Sliver C2 session**.
2.  Run the deletion command again:

    ```shell
    vssadmin delete shadows /all
    ```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FPbnEy6oa9TpiPhOzgFXA%2Fimage.png?alt=media&#x26;token=f6bd8224-ca81-4c87-9c24-77060931326b" alt="" width="563"><figcaption></figcaption></figure>

3. Run:

<pre class="language-shell"><code class="lang-shell"><strong>whoami
</strong></code></pre>

If the rule worked, the shell will **hang or exit**, confirming the process was terminated.

To manually exit the shell, press **Ctrl + D**.\
\
<mark style="color:yellow;">Notice</mark> :&#x20;

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FzCaQUckVeDLzI0y6bUKa%2Fimage.png?alt=media&#x26;token=29062671-cde5-41ca-a9e1-fc753d0c45ed" alt=""><figcaption></figcaption></figure>

&#x20;Your rule stopped the process that was running your command.

When you ran `vssadmin delete shadows /all`, LimaCharlie detected it and **killed the process that started your shell**. Since your shell depended on that process, it also got closed.

So when you tried `whoami`, the shell was already dead, which is why you saw **"Shell exited."**\
\


***

### **Next Steps: Strengthening the Rule**
