SignalHunt
← All incidents

2026-02-27

Exposed Service to Domain-Wide Ransomware: 19 Days of Warnings

Jump to the interactive walkthrough ↓

The exploit landed on a Saturday night. The ransomware ran nineteen days later, on a Thursday, and took under ninety minutes once it started. Everything interesting about this intrusion happened in the gap.

This is a simulated incident — our own hosts, our own narrative, our own synthetic logs — built on the technique sequence documented publicly by The DFIR Report in their Apache ActiveMQ / LockBit case. Their analysis is their own work and worth reading in full; nothing here reproduces it. What's reproduced is the shape of the attack, run against this catalogue's real detection rules to see which parts it would actually have caught.

The nineteen days are the whole story

Ransomware timelines get discussed as though the encryption is the incident. It isn't. Encryption is the receipt. By the time LB3.exe executes, every decision that mattered has already been made — and in this chain, there were nineteen days of them.

So the exercise below isn't "would you have detected the ransomware". It's: given a catalogue of 52 real rules, how early could you have stopped this, and what would it have cost you to be ready?

What gets caught, and what doesn't

Four of the six stages are covered. Two are not, and neither gap is an oversight.

The initial exploit is invisible to this catalogue. It arrives over the broker's own binary wire protocol — not HTTP. Every web-facing rule here (WAF, reverse proxy, web server) is pointed at a protocol the attack never touches. This is worth sitting with, because the catalogue does have eight rules tagged to the same ATT&CK technique. The flow shows them, under "parallel detections". Technique coverage on a heatmap is not the same as being able to see the attack, and this stage is what that distinction looks like in practice.

Ransomware execution is deliberately undetected too. An alert when the encryptor runs tells you what you are about to lose, not how to keep it. Every response action at that stage is recovery. Every action that would have changed the outcome sits in the five stages above it.

The one that should sting is stage three. The Security log was cleared on the file server seventeen days before anything was encrypted. WIN-1007 catches that, and log clearing is about as unambiguous a signal as this job offers — it is almost never anything but someone destroying evidence. The rule existed. The event fired. Nobody was watching.

The host you can't save

One host stays Unknown no matter what plan you build. The reception workstation has no Sysmon deployed, so there's no telemetry for it in the window — it may be untouched, it may have been encrypted, and the logs cannot say. No containment action changes that, because a containment cap tells you nothing about a host you cannot see.

That row is the honest one, and it's the same point the phishing walkthrough makes with its unmanaged personal device. Coverage gaps don't show up as alerts. They show up as rows you can't answer questions about, during the week you most need answers.

Work the chain

Expand any stage for its detection rules, its MITRE techniques, and the response actions available at that point. Check an action and the impact panel recomputes — checking one assumes that control existed before the intrusion started, capping how far the attacker could get.

Stages flagged amber have either no detection rule or no response action in your plan yet. Try building the cheapest plan that gets Encrypted to zero, then look at which SANS phase your chosen actions actually fall into. On this incident, most of the ones that work are Preparation — things that had to be true before the Saturday night, not decisions made during the Thursday.

🧨 Exposed Broker to Domain-Wide Ransomware

Initial Access: CVE-2023-46604 on an internet-facing Apache ActiveMQ broker

First Seen: 2026-02-08T22:41:00+00:00

Encrypted At: 2026-02-27T21:44:00+00:00

Dwell Time: 19 days from first exploit to encryption

Final Deployment Window: under 90 minutes

Hosts In Scope: 8

Ransomware Binaries: LB3.exe, LB3_pass.exe

An original simulation, modelled on the technique sequence documented in The DFIR Report - Apache ActiveMQ Exploit Leads to LockBit Ransomware. Hosts, narrative and logs here are our own.

Try it: open a stage, check a response action, and watch the summary bar at the bottom of the screen show how many outcomes change.

Kill chain — click a stage to expand

🧨 Exposed Broker to Domain-Wide Ransomware

T1190

A deserialisation flaw in an internet-facing message broker is exploited to run code as the service account. The same broker is hit twice, 18 days apart - the first visit establishes access, the second one uses it.

Blind spot: The exploit rides the broker's own binary wire protocol, not HTTP - so no WAF, reverse proxy or web server rule in the catalogue can see it. Nothing is wrong with those rules; they are simply pointed at a protocol this attack never touches. The realistic controls here are inventory and patch latency, not detection: an unpatched broker reachable from the internet is a finding long before it is an alert.

Not yet in your plan — no response action checked for this stage.

Identification (detection rule)

No internal detection rule covers this step.

Parallel detections (same MITRE technique, different log source)

Response actions (SANS phase tagged)

Checking a response action assumes that control existed before this campaign started — it caps every user's outcome at that stage. It's a teaching simplification, not a claim about what any single mid-incident action would retroactively undo.

0 actions checkedNo outcomes changed yetFull impact ↓

Your Incident Response Plan

Identification — rules referenced

None selected yet — click a rule chip on any stage.

Response actions, by SANS phase

None selected yet — check a response action on any stage.

Impact: Before vs. After Your Plan

Before (as the incident actually unfolded)

1

Safe

1

Unknown

0

At Risk

🚨 4

Compromised

🔥 2

Encrypted

After (with your selected response actions)

1

Safe

1

Unknown

0

At Risk

🚨 4

Compromised

🔥 2

Encrypted

Host Triage

NameOriginalRevisedFurthest StageHostNotesEvidence
Message Broker🚨 Compromised🚨 CompromisedDefense Evasion and Credential AccessSRV-MQ01Patient zero - the exposed broker. Exploited twice 18 days apart, and the first host to have its LSASS memory read.
Exchange Server🚨 Compromised🚨 CompromisedDefense Evasion and Credential AccessSRV-EXCH01Endpoint protection disabled before tooling was staged, then credentials harvested. Not encrypted - but every credential cached on it must be treated as lost.
File Server🔥 Encrypted🔥 EncryptedRansomware DeploymentSRV-FILE01Carried the remote access tool and had its Security log cleared 17 days before encryption. The cleared log was itself the loudest available signal, and no one was watching for it.
Backup Server🔥 Encrypted🔥 EncryptedRansomware DeploymentSRV-BACKUP01Reached over RDP with the stolen service account and encrypted first, deliberately - removing the recovery option before anyone noticed the rest.
Domain Controller🚨 Compromised🚨 CompromisedDiscovery and Lateral MovementSRV-DC01Used for discovery and authentication during lateral movement. Not encrypted, but a domain controller in the blast radius means the whole domain needs rebuilding regardless.
Finance Workstation🚨 Compromised🚨 CompromisedDiscovery and Lateral MovementWKSTN-042Reached by remote service execution running obfuscated PowerShell under a service account - a workstation with no business reason to run either.
Print Server Safe SafeNever reachedSRV-PRINT01Never touched. It sits on a segment the stolen credentials had no rights to, which is the only reason it survived.none
Reception Workstation Unknown UnknownInternet-Facing ExploitWKSTN-119No Sysmon deployed, so there is no telemetry for this host in the window. It may be untouched or it may have been encrypted - the logs cannot say, and no containment action changes that. Treat as compromised until proven otherwise.none