Ransomware

Encryption-based extortion attack targeting files, databases, or entire systems with ransom demands for decryption keys.

Triage

4 procedures

Bound the Investigation Timeframe

Identify Patient Zero (First Compromised System)

Analyze Ransom Note and Variant Identification

Validate the Initial Access Vector

Containment

4 procedures

Network Isolation of Compromised Systems

Credential and Account Lockdown

Block Active Exfiltration Pathways

Halt Ransomware Propagation

Sponsored

Preservation

4 procedures

Volatile Memory Capture

Log Preservation and Snapshot

Preserve VSS Shadow Copies and Encryption Timing Artifacts

Document Chain of Custody for All Collected Evidence

Collection

4 procedures

EDR Telemetry Collection

M365 Unified Audit Log Collection

Identify Alternative Evidence When Primary Logs Are Missing

Coordinate Log Collection from Third-Party Vendors

Analysis

5 procedures

Lateral Movement Analysis and Mapping

Map Exfiltration Channels (HTTP, DNS, Cloud Sync)

Determine Encryption Scope and Affected Systems

Analyze Evidence of Credential Dumping Techniques

Identify Data Staging and Compression Activity

Eradication

6 procedures

Remove Malware, Backdoors, and Persistence Mechanisms

Mass Credential Reset and Session Invalidation

Comprehensive Persistence Mechanism Sweep

Eradication Verification Checklist

Assume-Breach Rebuild and Identity Reset

Post-Incident Configuration Hardening

Recovery

4 procedures

Assess Decryption Options (Backups, Keys, Tools)

Rebuild Compromised Systems from Known-Good Images

Validate Backup Integrity Before Restoration

Phased Service Restoration with Enhanced Monitoring

Post-Incident Review

4 procedures

Create New Detection Rules Based on Incident Findings

Generate Comprehensive Incident Report

Review Ransomware Resilience and Backup Isolation Failures

Conduct Lessons Learned Review Session