Ransomware doesn't announce itself politely. By the time you see the first ransom note or encrypted file extension, the attacker has likely been in your environment for days or weeks, exfiltrating data, disabling backups, and staging the payload across multiple systems. The encryption event is the final act — but your response in the first 60 minutes can still determine whether you lose a handful of systems or your entire infrastructure.
This guide breaks down the critical first hour into three phases, each with specific actions, decision points, and common mistakes to avoid.
Phase 1: Detection & Initial Triage (Minutes 0–15)
The first few minutes are about confirming what you're dealing with and activating your response structure. Not every suspicious alert is ransomware, and false positives waste precious time if you escalate prematurely.
- Verify the detection — Confirm ransomware indicators: encrypted files with unusual extensions, ransom notes on desktops, mass file rename activity in monitoring tools
- Identify affected systems — Use your EDR console, SIEM, or network monitoring to determine how many endpoints show encryption activity
- Classify the scope — Is this a single workstation, a department, or enterprise-wide? Scope determines your containment strategy
Once you've confirmed ransomware activity, activate your incident response team immediately. Every minute of delay is a minute the attacker uses to encrypt more systems.
- Page the IR team — Use your on-call rotation. Don't send emails — the email system may be compromised
- Assign roles — Incident Commander, Technical Lead, Communications Lead, Scribe. If you have an IR plan, follow it
- Establish a command channel — Set up a dedicated communication channel outside your corporate infrastructure (Signal, out-of-band phone bridge, etc.)
Gather enough intelligence to make informed containment decisions in the next phase.
- Identify the ransomware variant — Ransom notes, encrypted file extensions, and process names can help identify the specific strain. Tools like ID Ransomware can assist
- Check for data exfiltration indicators — Many modern ransomware groups exfiltrate data before encrypting. Check for unusual outbound data transfers in network logs
- Assess backup status — Determine whether your backups are intact, offline, or potentially compromised. Attackers routinely target backup systems first
Phase 2: Containment Decisions (Minutes 15–30)
Containment is the most critical phase. The goal is to stop the spread of encryption while preserving as much evidence as possible. Every containment action has trade-offs, and the right choice depends on your specific situation.
Network-level containment is typically the fastest way to stop lateral spread.
- Isolate affected network segments — Use firewall rules or network switches to cut off affected VLANs from the rest of the network
- Block known C2 communications — If you've identified command-and-control infrastructure, block those IPs and domains at the perimeter immediately
- Disable compromised accounts — If you've identified the attacker's access accounts, disable them in Active Directory. Consider resetting the
krbtgtaccount if domain compromise is suspected
Network isolation alone isn't enough. You need endpoint-level containment to stop encryption on individual systems.
- Use EDR to isolate endpoints — Most EDR platforms support network isolation that keeps the endpoint reachable by the EDR console while cutting off all other network access
- Do NOT power off systems — This is a critical mistake. Powering off destroys volatile memory, active network connections, and running process data that is essential for forensics
- If no EDR is available — Disconnect network cables (don't power off). For wireless-only devices, disable Wi-Fi adapters
- Monitor for new encryption activity — Are new systems still being affected after containment actions?
- Verify critical system status — Check domain controllers, backup servers, and other Tier 0 assets
- Decide on external support — If the scope exceeds your team's capacity, this is the time to engage external IR support. Don't wait until hour four
Phase 3: Evidence Preservation & Communication (Minutes 30–60)
With containment underway, the next priority is preserving evidence and activating your communication protocols. These actions run in parallel.
Every action you take (or fail to take) in this window affects your ability to investigate the breach, meet regulatory requirements, and potentially pursue legal action.
- Capture volatile data first — Memory dumps from key systems (especially domain controllers and the initial infection point). Use tools like
winpmemor your EDR's memory capture capability - Collect critical logs — Security event logs, Sysmon logs, PowerShell logs, and EDR telemetry. These may be targets for deletion by the attacker. See our Windows forensic artifacts guide for a complete collection checklist
- Create forensic images — Prioritize imaging the initial infection point and any systems with indicators of attacker activity
- Preserve ransom notes and encrypted samples — These contain strain identification and potentially decryption information
At this point, your Communications Lead should activate the notification process.
- Brief executive leadership — Provide scope, current status, and expected next steps. Avoid speculation about attribution or total impact
- Engage legal counsel — Breach notification requirements vary by jurisdiction and data type. Legal needs to assess regulatory obligations early
- Notify your cyber insurance carrier — Most policies have notification windows. Late notification can affect coverage
- Prepare holding statements — Draft internal and external communications. Do not disclose technical details publicly at this stage
- Establish investigation priorities — Initial access vector, lateral movement timeline, data exfiltration scope
- Resource planning — Do you need additional IR capacity? Forensic specialists? Legal support?
- Set a briefing cadence — Establish regular update intervals for leadership (every 2–4 hours in the first 24 hours)
- Document everything — Ensure your Scribe has captured every decision, action, and observation. This documentation is critical for the post-incident review and potential legal proceedings
Common Mistakes That Make Things Worse
In the pressure of an active ransomware incident, teams frequently make errors that compound the damage. Avoid these:
- Paying the ransom without an IR investigation — Payment doesn't remove the attacker from your environment. Without understanding their access, you'll likely be re-compromised
- Wiping systems before forensic imaging — Rebuilding infected systems destroys the evidence needed to understand the full scope of the breach and meet regulatory requirements
- Restoring from backups before confirming they're clean — If the attacker compromised your backup infrastructure, restoration reintroduces the threat
- Communicating over compromised channels — If the attacker has access to your email or Slack, they can read your response plans. Use out-of-band communication
- Delaying external IR engagement — The first 24 hours are the most critical for evidence collection. Bringing in external support at hour 48 means you've already lost valuable forensic data
After the First Hour
The first 60 minutes set the foundation, but ransomware recovery is a marathon. After the initial response, your priorities shift to root cause analysis, full scope assessment, system recovery, and long-term hardening. Having structured incident response playbooks ensures that each phase of the recovery follows a consistent, thorough process.
The organizations that recover successfully from ransomware are not the ones that improvised the best. They're the ones that had a plan, executed it under pressure, and adapted as the situation evolved.
Need Immediate IR Support?
If you're currently dealing with a ransomware incident, our IR team is available 24/7 for emergency deployment. Or explore our ransomware response playbook.