🔒 Ransomware

Identify Patient Zero (First Compromised System)

Patient Zero

Analyze Ransom Note and Variant Identification

Ransom Note Analysis

Validate the Initial Access Vector

Access Validation

Containment

(4 procedures)

Network Isolation of Compromised Systems

Network Isolation

Credential and Account Lockdown

Account Lockdown

Block Active Exfiltration Pathways

Block Exfiltration

Halt Ransomware Propagation

Stop Ransomware Spread

Preservation

(4 procedures)

Volatile Memory Capture

Memory Capture

Log Preservation and Snapshot

Log Snapshot

Preserve VSS Shadow Copies and Encryption Timing Artifacts

Ransomware Preservation

Document Chain of Custody for All Collected Evidence

Chain of Custody

Collection

(4 procedures)

EDR Telemetry Collection

EDR Collection

M365 Unified Audit Log Collection

M365 UAL Collection

Identify Alternative Evidence When Primary Logs Are Missing

Missing Log Fallback

Coordinate Log Collection from Third-Party Vendors

Third-Party Logs

Analysis

(5 procedures)

Lateral Movement Analysis and Mapping

Lateral Movement

Map Exfiltration Channels (HTTP, DNS, Cloud Sync)

Exfil Channels

Determine Encryption Scope and Affected Systems

Encryption Scope

Analyze Evidence of Credential Dumping Techniques

Credential Dumping

Identify Data Staging and Compression Activity

Data Staging

Eradication

(5 procedures)

Remove Malware, Backdoors, and Persistence Mechanisms

Malware Removal

Mass Credential Reset and Session Invalidation

Credential Reset

Comprehensive Persistence Mechanism Sweep

Persistence Hunt

Eradication Verification Checklist

Eradication Verification

Post-Incident Configuration Hardening

Config Hardening

180min

Recovery

(4 procedures)

Assess Decryption Options (Backups, Keys, Tools)

Decryption Assessment

Rebuild Compromised Systems from Known-Good Images

System Rebuild

240min

Validate Backup Integrity Before Restoration

Backup Validation

180min

Phased Service Restoration with Enhanced Monitoring

Service Restoration

Post-Incident Review

(3 procedures)

Create New Detection Rules Based on Incident Findings

Detection Improvement

Generate Comprehensive Incident Report

Incident Report

180min

Conduct Lessons Learned Review Session

Lessons Learned