# How to detect ransomware on the network

> The network warning signs that come before ransomware encrypts anything, mapped to MITRE ATT&CK, and what network detection can and cannot do.

Source page: https://netsenx.com/en/detect-ransomware-on-the-network

Last reviewed: November 7, 2026

Detecting ransomware on the network means catching the attack in the steps that come before any file is encrypted. An attacker first has to reach a machine, contact their own server, find the file servers and backups, move to them and, in most current attacks, copy data out to use as a second threat. Each of those steps crosses the network and leaves a pattern: regular check-ins with an outside server, one host scanning many others, new administrator sessions, a large upload at night. Encryption is the last step, and the one the network sees least.

## The fact to plan around

In joint advisory AA24-131A, first published on 10 May 2024, CISA, the FBI and partner agencies reported that Black Basta affiliates had affected over 500 organisations worldwide, used a double-extortion model that both encrypts systems and exfiltrates data, and used RClone to exfiltrate data before encryption.

Source: [CISA, FBI, HHS and MS-ISAC — Joint advisory AA24-131A, #StopRansomware: Black Basta, first published 10 May 2024](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a)

## Warning signs on the network, in the order they usually appear

None of them proves ransomware on its own. Seen in this order, or together, they deserve an investigation the same day.

1. **A new outside server, contacted at regular intervals** A workstation starts connecting to a destination nobody else uses, every few minutes, day and night. That is often the attacker's command-and-control channel, or a remote-access tool nobody approved.
2. **One host scanning the internal network** The compromised machine probes internal ranges for open SMB (445), RDP (3389) and database ports, looking for file servers, backups and domain controllers.
3. **New administrator sessions to many servers** Remote sessions over SMB, RDP or WinRM from a workstation to servers it has never used, often outside working hours, show the attacker moving towards the data.
4. **A large upload before anything is encrypted** Copying data out to cloud storage, with tools such as RClone, shows up as unusual outbound volume from a server that normally sends little, often at night.
5. **Heavy reading and rewriting on file shares** When encryption starts, one client reads and rewrites large amounts of data on network shares in a short time. At this point containment comes first.

## Mapped to MITRE ATT&CK

Technique names and IDs are MITRE's. The last column names the NetSenX detection category this traffic falls under; it does not mean every variant of the technique is caught.

| Technique | What it looks like on the network | NetSenX detection |
|---|---|---|
| [T1046](https://attack.mitre.org/techniques/T1046/) Network Service Discovery (Discovery) | One host connecting to many internal addresses on SMB, RDP or database ports within a short time. | Scanning |
| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) Remote Services: SMB/Windows Admin Shares (Lateral Movement) | A workstation opening SMB sessions with administrator shares on servers it has never used. | Lateral movement |
| [T1071](https://attack.mitre.org/techniques/T1071/) Application Layer Protocol (Command and Control) | Small, regular connections to one external destination over HTTPS, day and night. | C2 beaconing |
| [T1567.002](https://attack.mitre.org/techniques/T1567/002/) Exfiltration Over Web Service: Exfiltration to Cloud Storage (Exfiltration) | A server uploading far more data than usual to a cloud storage service. | Unusual outbound data volume |
| [T1486](https://attack.mitre.org/techniques/T1486/) Data Encrypted for Impact (Impact) | Encryption runs on the hosts. Where it hits network shares, one client reads and rewrites large volumes over SMB. | No dedicated detection: NetSenX watches the steps before it |

## What NetSenX does today

- Detects scanning, lateral movement, C2 beaconing and unusual outbound data volume from network behaviour, on every plan, Free included.
- Explains every alert in plain language, listing the network features that drove its score, so a small team can tell an intrusion from a new backup job.
- Names the MITRE ATT&CK technique on the alert where a detection corresponds to one, and shows in a coverage view which techniques your enabled detections address.
- Tracks the NIS2 Article 23 deadlines if an incident turns out to be significant, and prepares a GDPR Article 33 breach notification for your DPO.

## What NetSenX does not do

NetSenX does not stop encryption on a host, does not restore files and has no dedicated detection for the encryption step itself: endpoint protection (EDR) and offline backups cover that ground. It sees only the segments you monitor and never decrypts traffic. An attack that starts and ends on one machine gives the network little to see, and an alert is a reason to investigate, not proof of ransomware.

## Questions buyers ask

### What are the early warning signs of ransomware on a network?

Regular connections from a workstation to a new outside server, one host scanning internal ranges for SMB, RDP or database ports, new administrator sessions to many servers, and a large upload to cloud storage from a server that normally sends little. They usually come in that order, before any file is encrypted.

### Can network monitoring detect ransomware before encryption?

Often, because the steps before encryption cross the network: command-and-control check-ins, scanning, lateral movement and data theft. That is the window in which an attack can still be stopped. Not every attack shows all of them, and an attack confined to one machine gives the network little to see.

### Does NetSenX stop ransomware?

No. NetSenX alerts on the network behaviour that usually comes before ransomware, so your team can act while there is still time. Isolating hosts, removing the attacker and restoring data stay with your team, your endpoint protection and your backups.

### What should we do first if we see these signs?

Disconnect the affected hosts from the network, keep their logs, reset the credentials used on them and call your incident-response provider. If your organisation is in scope of NIS2, the 24-hour early warning starts when you become aware of a significant incident.

## Sources

- [CISA, FBI, HHS and MS-ISAC — Joint advisory AA24-131A, #StopRansomware: Black Basta, first published 10 May 2024](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a)
- [MITRE ATT&CK — Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)
- [Directive (EU) 2022/2555 (NIS2), Articles 21, 23 and 41 — EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

## Related pages

- [How to detect lateral movement and C2 beaconing](https://netsenx.com/en/detect-lateral-movement-c2-beaconing)
- [How to tell if someone is inside your network](https://netsenx.com/en/is-someone-inside-your-network)
- [NIS2 network monitoring](https://netsenx.com/en/nis2-network-monitoring)
- [What is NDR?](https://netsenx.com/en/what-is-ndr)
- [Pricing and the Free plan](https://netsenx.com/en/pricing)