Overview

Ransomware attacks continue to be one of the most devastating cyber threats, capable of crippling organizations within hours. This playbook provides a structured approach to ransomware incident response, following the NIST Cybersecurity Framework and industry best practices.

Who Should Use This Playbook:

Incident Response (IR) teams responding to active incidents
Security Operations Center (SOC) analysts
IT administrators handling security events
CISOs and security leaders developing IR procedures

NIST Incident Response Lifecycle:

┌────────────────────────────────────────────────────────────────────┐
│                    NIST IR Lifecycle                                │
├────────────────────────────────────────────────────────────────────┤
│                                                                    │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐         │
│  │  Preparation │───▶│  Detection & │───▶│ Containment, │         │
│  │              │    │   Analysis   │    │ Eradication, │         │
│  │              │    │              │    │  & Recovery  │         │
│  └──────────────┘    └──────────────┘    └──────┬───────┘         │
│         ▲                                        │                 │
│         │         ┌──────────────┐               │                 │
│         └─────────│Post-Incident │◀──────────────┘                 │
│                   │  Activity    │                                 │
│                   └──────────────┘                                 │
│                                                                    │
└────────────────────────────────────────────────────────────────────┘

Severity Classification:

Severity	Criteria	Response Time
Critical	Production systems encrypted, business stopped	Immediate (24/7)
High	Significant systems affected, spreading	< 1 hour
Medium	Limited scope, contained to segment	< 4 hours
Low	Single endpoint, no spread	< 24 hours

Phase 1: Detection and Identification

Initial Detection Sources

Common Ransomware Indicators:

Source	Indicator	Priority
EDR Alert	Ransomware behavior detected	Critical
User Report	Files encrypted, ransom note	Critical
SIEM Alert	Mass file encryption activity	Critical
AV Alert	Known ransomware signature	High
File Server	Unusual file extension changes	High
Backup System	Backup deletion attempts	High
Network Monitor	C2 communication detected	High

Initial Triage Checklist:

□ Confirm this is ransomware (not false positive)
□ Identify affected systems (hostname, IP, user)
□ Determine ransomware variant if possible
□ Assess current scope (endpoints, servers, segments)
□ Check if attack is active or completed
□ Identify any ransom notes or communications
□ Document initial timeline of events

Ransomware Identification

Collect Ransom Note:

# Search for common ransom note filenames
$ransomNotes = @(
    "*README*.txt", "*DECRYPT*.txt", "*RESTORE*.txt",
    "*HOW_TO*.txt", "*HELP*.txt", "*.hta"
)
 
foreach ($pattern in $ransomNotes) {
    Get-ChildItem -Path "C:\" -Filter $pattern -Recurse -ErrorAction SilentlyContinue |
    Select-Object FullName, LastWriteTime | Format-Table
}

Identify Ransomware Family:

ID Ransomware: https://id-ransomware.malwarehunterteam.com/
No More Ransom: https://www.nomoreransom.org/
Upload encrypted file sample + ransom note
Document identified variant and known decryptors

Collect Encrypted File Sample:

# Find recently modified encrypted files
Get-ChildItem -Path "C:\Users" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) } |
Where-Object { $_.Extension -match "\.(encrypted|locked|crypt|enc)$" } |
Select-Object -First 5 FullName, Extension, LastWriteTime

Phase 2: Containment

Immediate Containment Actions

CRITICAL: Within First 15 Minutes

┌─────────────────────────────────────────────────────────────────┐
│              IMMEDIATE CONTAINMENT ACTIONS                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. ISOLATE affected systems from network                       │
│     - Disable network adapter (don't power off)                 │
│     - Block at switch port / firewall                          │
│     - Quarantine in EDR                                         │
│                                                                 │
│  2. PRESERVE evidence                                           │
│     - Do NOT shut down systems (memory forensics)              │
│     - Take screenshots of ransom notes                         │
│     - Document all actions with timestamps                     │
│                                                                 │
│  3. PROTECT backup systems                                      │
│     - Disconnect backup infrastructure                          │
│     - Verify backup integrity                                   │
│     - Air-gap critical backups                                  │
│                                                                 │
│  4. ALERT key stakeholders                                      │
│     - IR team lead                                              │
│     - IT management                                             │
│     - Legal/Compliance (if required)                           │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Network Isolation Commands:

# PowerShell - Disable network adapters (preserves memory)
Get-NetAdapter | Disable-NetAdapter -Confirm:$false
 
# Windows - Isolate via Windows Firewall
netsh advfirewall set allprofiles state on
netsh advfirewall firewall add rule name="IR-Block-All" dir=out action=block
netsh advfirewall firewall add rule name="IR-Block-In" dir=in action=block

EDR Isolation (Examples):

# Microsoft Defender for Endpoint
# Via Security Center: Device page → Isolate device
 
# SentinelOne
# Console: Sentinels → Select agent → Actions → Network Quarantine
 
# CrowdStrike Falcon
# Console: Hosts → Select host → Network Contain

FortiGate Quarantine:

# Block specific IP at firewall
config firewall address
    edit "Quarantine-<Hostname>"
        set type ipmask
        set subnet <IP> 255.255.255.255
    next
end
 
config firewall policy
    edit 0
        set name "Block-Quarantine"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "Quarantine-<Hostname>"
        set dstaddr "all"
        set action deny
        set schedule "always"
        set service "ALL"
    next
end

Contain Lateral Movement

Identify Potential Spread:

# Check for lateral movement indicators
# Recent RDP connections
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" -MaxEvents 50 |
Where-Object { $_.Id -eq 21 -or $_.Id -eq 25 } |
Select-Object TimeCreated, Message
 
# Recent SMB connections
Get-SmbConnection | Select-Object ServerName, ShareName, UserName
 
# Check scheduled tasks for persistence
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } |
Select-Object TaskName, TaskPath, Date

Block Lateral Movement Protocols:

# FortiGate - Block SMB/RDP between segments during incident
config firewall policy
    edit 0
        set name "IR-Block-Lateral"
        set srcintf "internal"
        set dstintf "internal"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set service "SMB" "RDP"
        set schedule "always"
    next
end

Active Directory Protections:

# Reset compromised accounts
Set-ADAccountPassword -Identity "<compromised-user>" -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "TempP@ss123!" -Force)
Disable-ADAccount -Identity "<compromised-user>"
 
# Reset KRBTGT (twice, 10+ hours apart for full rotation)
# WARNING: This will invalidate all Kerberos tickets
# Only do this if AD compromise is confirmed
# Reset-KrbtgtPassword -DomainName "domain.local"

Phase 3: Evidence Collection

Forensic Evidence Preservation

Evidence Collection Priority:

Priority	Evidence Type	Volatility
1	Memory (RAM)	Very High
2	Running processes	Very High
3	Network connections	High
4	Logs (Security, System)	Medium
5	Disk image	Low
6	Ransom notes, encrypted files	Low

Memory Acquisition:

# Using WinPMEM (download from GitHub)
.\winpmem_mini_x64.exe memory.raw
 
# Using DumpIt
.\DumpIt.exe
 
# Output location: Document and preserve chain of custody

Collect Volatile Data:

# Create collection directory
$collectionPath = "C:\IR-Collection-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $collectionPath
 
# Running processes
Get-Process | Select-Object Id, ProcessName, Path, StartTime |
Export-Csv "$collectionPath\processes.csv" -NoTypeInformation
 
# Network connections
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess |
Export-Csv "$collectionPath\network-connections.csv" -NoTypeInformation
 
# DNS cache
Get-DnsClientCache | Export-Csv "$collectionPath\dns-cache.csv" -NoTypeInformation
 
# Scheduled tasks
Get-ScheduledTask | Export-Csv "$collectionPath\scheduled-tasks.csv" -NoTypeInformation
 
# Services
Get-Service | Select-Object Name, DisplayName, Status, StartType |
Export-Csv "$collectionPath\services.csv" -NoTypeInformation
 
# Recent file modifications
Get-ChildItem -Path "C:\" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) } |
Export-Csv "$collectionPath\recent-files.csv" -NoTypeInformation

Export Windows Event Logs:

# Security log
wevtutil epl Security "$collectionPath\Security.evtx"
 
# System log
wevtutil epl System "$collectionPath\System.evtx"
 
# PowerShell logs
wevtutil epl "Microsoft-Windows-PowerShell/Operational" "$collectionPath\PowerShell.evtx"
 
# Defender logs
wevtutil epl "Microsoft-Windows-Windows Defender/Operational" "$collectionPath\Defender.evtx"

Timeline Analysis

Key Events to Identify:

Event	Windows Event ID	Significance
Logon	4624	Initial access point
Failed logon	4625	Brute force attempts
Process creation	4688	Malware execution
Service installed	7045	Persistence mechanism
RDP connection	1149	Lateral movement
SMB share access	5140	Data access
Scheduled task	4698	Persistence
PowerShell execution	4104	Script execution

Query Security Logs:

# Find initial access (Type 10 = Remote RDP, Type 3 = Network)
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4624
} -MaxEvents 1000 |
Where-Object { $_.Properties[8].Value -in @(3, 10) } |
Select-Object TimeCreated,
    @{N='Account'; E={$_.Properties[5].Value}},
    @{N='LogonType'; E={$_.Properties[8].Value}},
    @{N='SourceIP'; E={$_.Properties[18].Value}}
 
# Find process creation events
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4688
} -MaxEvents 500 |
Select-Object TimeCreated,
    @{N='Process'; E={$_.Properties[5].Value}},
    @{N='CommandLine'; E={$_.Properties[8].Value}}

Phase 4: Eradication

Remove Ransomware Artifacts

Identify Persistence Mechanisms:

# Check Run keys
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
 
# Check scheduled tasks
Get-ScheduledTask | Where-Object { $_.State -eq "Ready" } |
Select-Object TaskName, TaskPath, @{N='Actions'; E={$_.Actions.Execute}}
 
# Check services
Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike "*Windows*" } |
Select-Object Name, PathName, StartMode
 
# Check startup folder
Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"

Remove Persistence:

# Remove malicious scheduled task
Unregister-ScheduledTask -TaskName "<malicious-task>" -Confirm:$false
 
# Remove malicious service
Stop-Service -Name "<malicious-service>" -Force
sc.exe delete "<malicious-service>"
 
# Remove registry persistence
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "<malicious-entry>"
 
# Delete malicious files (after forensic collection)
Remove-Item -Path "<malicious-file-path>" -Force

Clean with EDR:

Run full system scan
Review and remediate all detections
Verify no active threats remain
Check for dormant/scheduled malware

Validate Clean State

Verification Checklist:

□ No malicious processes running
□ No suspicious network connections
□ No persistence mechanisms remain
□ EDR shows clean status
□ AV scan completes with no detections
□ Startup items verified clean
□ Scheduled tasks reviewed
□ Services reviewed
□ User accounts audited

Phase 5: Recovery

Recovery Priority

Recovery Order:

Priority	Systems	Justification
1	Domain Controllers	Authentication required for all systems
2	DNS/DHCP	Network services
3	Backup Infrastructure	Required for restoration
4	Critical Business Systems	Revenue/operations
5	File Servers	User data access
6	End User Workstations	Employee productivity

Restore from Backup

Pre-Restoration Checks:

□ Backup integrity verified (not encrypted)
□ Backup predates infection (check timeline)
□ Clean environment ready for restoration
□ Network isolation maintained during restore
□ Credentials reset for restored systems

Restoration Process:

Verify backup integrity

# Veeam - Check backup job status
Get-VBRBackup | Where-Object { $_.JobType -eq "Backup" } |
Select-Object Name, LastResult, LastPointCreationTime
 
# Azure Backup - List recovery points
az backup recoverypoint list --resource-group <RG> --vault-name <Vault> --container-name <Container> --item-name <Item>

Restore to isolated network

- Create isolated VLAN for restoration
- No connection to production network
- Verify restored system is clean
- Run full security scan
- Check for persistence

Validate before reconnection

# Verify no malicious files
Get-ChildItem -Path "C:\" -Recurse -Include "*.exe", "*.dll" -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt $infectionDate } |
Select-Object FullName, LastWriteTime
 
# Verify no scheduled tasks
Get-ScheduledTask | Where-Object { $_.Date -gt $infectionDate }
 
# Verify services
Get-Service | Where-Object { $_.Status -eq "Running" -and $_.StartType -eq "Automatic" }

Password Reset Strategy

Critical Password Resets:

Account Type	Action	Priority
Domain Admin	Reset immediately	Critical
Service Accounts	Reset and update services	Critical
KRBTGT	Reset twice (10+ hours apart)	High
All privileged accounts	Reset before reconnection	High
All user accounts	Force password change at logon	Medium

# Force password change for all users
Get-ADUser -Filter * | Set-ADUser -ChangePasswordAtLogon $true
 
# Reset specific privileged account
Set-ADAccountPassword -Identity "admin-account" -Reset -NewPassword (Read-Host -AsSecureString "New Password")

Phase 6: Post-Incident Activities

Lessons Learned

Post-Incident Review Meeting:

Topic	Questions to Address
Detection	How was the incident detected? Could we detect earlier?
Response	What went well? What could be improved?
Containment	Was containment effective? How fast?
Communication	Were stakeholders informed appropriately?
Tools	Did our tools perform as expected?
Training	What training gaps were identified?

Documentation Requirements:

1. Incident Timeline
   - Initial detection time
   - Key response actions with timestamps
   - Recovery completion time
   - Total incident duration
 
2. Technical Analysis
   - Attack vector (how did they get in?)
   - Ransomware variant and behavior
   - Systems affected
   - Data potentially exfiltrated
 
3. Business Impact
   - Downtime duration
   - Systems affected
   - Data loss (if any)
   - Financial impact estimate
 
4. Recommendations
   - Security improvements needed
   - Process improvements
   - Training needs
   - Tool enhancements

Improve Defenses

Common Ransomware Attack Vectors:

Vector	Mitigation
Phishing email	Email filtering, user training, DMARC
RDP exposure	MFA, VPN-only access, network segmentation
Vulnerable software	Patch management, vulnerability scanning
Compromised credentials	MFA, privileged access management, credential monitoring
Supply chain	Vendor assessment, software allowlisting

Recommended Improvements:

□ Implement/improve backup strategy (3-2-1 rule, air-gapped)
□ Enable MFA on all privileged accounts
□ Deploy EDR with ransomware protection
□ Implement network segmentation
□ Enable PowerShell logging and constraints
□ Improve email filtering and user training
□ Establish incident response retainer
□ Conduct regular IR tabletop exercises

Communication Templates

Internal Notification

SUBJECT: [SECURITY INCIDENT] Ransomware Detected - ACTION REQUIRED
 
Priority: CRITICAL
Time: [TIMESTAMP]
Incident ID: [IR-YYYY-###]
 
SITUATION:
We have detected ransomware activity affecting [SCOPE]. The Incident Response team is actively responding.
 
IMMEDIATE ACTIONS:
1. Do NOT attempt to access affected systems
2. Do NOT open suspicious emails or attachments
3. Report any unusual system behavior immediately
4. [Additional specific instructions]
 
CURRENT STATUS:
- Affected systems have been isolated
- Investigation is ongoing
- Backup integrity is being verified
 
NEXT UPDATE: [TIME]
 
Contact: [IR Team Contact]

Executive Brief

EXECUTIVE INCIDENT BRIEF
Incident: Ransomware Attack
Date: [DATE]
Status: [Active Response / Contained / Recovered]
 
SUMMARY:
[Brief description of incident, scope, and current status]
 
IMPACT:
- Systems Affected: [COUNT/LIST]
- Business Functions Impacted: [LIST]
- Estimated Downtime: [DURATION]
- Data at Risk: [ASSESSMENT]
 
RESPONSE STATUS:
- Containment: [Complete/In Progress]
- Eradication: [Complete/In Progress]
- Recovery: [Complete/In Progress/Pending]
 
NEXT STEPS:
1. [Action item]
2. [Action item]
3. [Action item]
 
ESTIMATED RECOVERY: [TIMEFRAME]

Quick Reference

Critical Contact List

Role	Contact	Responsibility
IR Lead	[Name/Phone]	Overall incident command
IT Operations	[Name/Phone]	System isolation and recovery
Security Team	[Name/Phone]	Investigation and analysis
Legal/Compliance	[Name/Phone]	Regulatory requirements
Communications	[Name/Phone]	Internal/external messaging
Executive Sponsor	[Name/Phone]	Business decisions
External IR Firm	[Name/Phone]	Additional support if needed
Cyber Insurance	[Policy #/Phone]	Claim notification
Law Enforcement	FBI IC3/Local	Reporting if required

Decision Tree

RANSOMWARE DETECTED
        │
        ▼
Is attack active (spreading)?
    │           │
   YES          NO
    │           │
    ▼           ▼
ISOLATE       Assess scope
IMMEDIATELY   and impact
    │           │
    ▼           ▼
Preserve      Collect
evidence      evidence
    │           │
    └─────┬─────┘
          ▼
    Can we recover
    from backup?
    │           │
   YES          NO
    │           │
    ▼           ▼
Proceed to    Consider
recovery      options*
    │           │
    ▼           ▼
Reset all     Engage legal,
credentials   insurance, IR firm

*Options may include negotiation as last resort - always involve legal and insurance.

Verification Checklist

Incident Closed Criteria:

References

Last Updated: February 2026

Overview

Who Should Use This Playbook:

Incident Response (IR) teams responding to active incidents
Security Operations Center (SOC) analysts
IT administrators handling security events
CISOs and security leaders developing IR procedures

NIST Incident Response Lifecycle:

┌────────────────────────────────────────────────────────────────────┐
│                    NIST IR Lifecycle                                │
├────────────────────────────────────────────────────────────────────┤
│                                                                    │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐         │
│  │  Preparation │───▶│  Detection & │───▶│ Containment, │         │
│  │              │    │   Analysis   │    │ Eradication, │         │
│  │              │    │              │    │  & Recovery  │         │
│  └──────────────┘    └──────────────┘    └──────┬───────┘         │
│         ▲                                        │                 │
│         │         ┌──────────────┐               │                 │
│         └─────────│Post-Incident │◀──────────────┘                 │
│                   │  Activity    │                                 │
│                   └──────────────┘                                 │
│                                                                    │
└────────────────────────────────────────────────────────────────────┘

Severity Classification:

Severity	Criteria	Response Time
Critical	Production systems encrypted, business stopped	Immediate (24/7)
High	Significant systems affected, spreading	< 1 hour
Medium	Limited scope, contained to segment	< 4 hours
Low	Single endpoint, no spread	< 24 hours

Phase 1: Detection and Identification

Initial Detection Sources

Common Ransomware Indicators:

Source	Indicator	Priority
EDR Alert	Ransomware behavior detected	Critical
User Report	Files encrypted, ransom note	Critical
SIEM Alert	Mass file encryption activity	Critical
AV Alert	Known ransomware signature	High
File Server	Unusual file extension changes	High
Backup System	Backup deletion attempts	High
Network Monitor	C2 communication detected	High

Initial Triage Checklist:

□ Confirm this is ransomware (not false positive)
□ Identify affected systems (hostname, IP, user)
□ Determine ransomware variant if possible
□ Assess current scope (endpoints, servers, segments)
□ Check if attack is active or completed
□ Identify any ransom notes or communications
□ Document initial timeline of events

Ransomware Identification

Collect Ransom Note:

# Search for common ransom note filenames
$ransomNotes = @(
    "*README*.txt", "*DECRYPT*.txt", "*RESTORE*.txt",
    "*HOW_TO*.txt", "*HELP*.txt", "*.hta"
)
 
foreach ($pattern in $ransomNotes) {
    Get-ChildItem -Path "C:\" -Filter $pattern -Recurse -ErrorAction SilentlyContinue |
    Select-Object FullName, LastWriteTime | Format-Table
}

Identify Ransomware Family:

ID Ransomware: https://id-ransomware.malwarehunterteam.com/
No More Ransom: https://www.nomoreransom.org/
Upload encrypted file sample + ransom note
Document identified variant and known decryptors

Collect Encrypted File Sample:

# Find recently modified encrypted files
Get-ChildItem -Path "C:\Users" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) } |
Where-Object { $_.Extension -match "\.(encrypted|locked|crypt|enc)$" } |
Select-Object -First 5 FullName, Extension, LastWriteTime

Phase 2: Containment

Immediate Containment Actions

CRITICAL: Within First 15 Minutes

┌─────────────────────────────────────────────────────────────────┐
│              IMMEDIATE CONTAINMENT ACTIONS                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. ISOLATE affected systems from network                       │
│     - Disable network adapter (don't power off)                 │
│     - Block at switch port / firewall                          │
│     - Quarantine in EDR                                         │
│                                                                 │
│  2. PRESERVE evidence                                           │
│     - Do NOT shut down systems (memory forensics)              │
│     - Take screenshots of ransom notes                         │
│     - Document all actions with timestamps                     │
│                                                                 │
│  3. PROTECT backup systems                                      │
│     - Disconnect backup infrastructure                          │
│     - Verify backup integrity                                   │
│     - Air-gap critical backups                                  │
│                                                                 │
│  4. ALERT key stakeholders                                      │
│     - IR team lead                                              │
│     - IT management                                             │
│     - Legal/Compliance (if required)                           │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Network Isolation Commands:

# PowerShell - Disable network adapters (preserves memory)
Get-NetAdapter | Disable-NetAdapter -Confirm:$false
 
# Windows - Isolate via Windows Firewall
netsh advfirewall set allprofiles state on
netsh advfirewall firewall add rule name="IR-Block-All" dir=out action=block
netsh advfirewall firewall add rule name="IR-Block-In" dir=in action=block

EDR Isolation (Examples):

# Microsoft Defender for Endpoint
# Via Security Center: Device page → Isolate device
 
# SentinelOne
# Console: Sentinels → Select agent → Actions → Network Quarantine
 
# CrowdStrike Falcon
# Console: Hosts → Select host → Network Contain

FortiGate Quarantine:

# Block specific IP at firewall
config firewall address
    edit "Quarantine-<Hostname>"
        set type ipmask
        set subnet <IP> 255.255.255.255
    next
end
 
config firewall policy
    edit 0
        set name "Block-Quarantine"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "Quarantine-<Hostname>"
        set dstaddr "all"
        set action deny
        set schedule "always"
        set service "ALL"
    next
end

Contain Lateral Movement

Identify Potential Spread:

# Check for lateral movement indicators
# Recent RDP connections
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" -MaxEvents 50 |
Where-Object { $_.Id -eq 21 -or $_.Id -eq 25 } |
Select-Object TimeCreated, Message
 
# Recent SMB connections
Get-SmbConnection | Select-Object ServerName, ShareName, UserName
 
# Check scheduled tasks for persistence
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } |
Select-Object TaskName, TaskPath, Date

Block Lateral Movement Protocols:

# FortiGate - Block SMB/RDP between segments during incident
config firewall policy
    edit 0
        set name "IR-Block-Lateral"
        set srcintf "internal"
        set dstintf "internal"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set service "SMB" "RDP"
        set schedule "always"
    next
end

Active Directory Protections:

# Reset compromised accounts
Set-ADAccountPassword -Identity "<compromised-user>" -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "TempP@ss123!" -Force)
Disable-ADAccount -Identity "<compromised-user>"
 
# Reset KRBTGT (twice, 10+ hours apart for full rotation)
# WARNING: This will invalidate all Kerberos tickets
# Only do this if AD compromise is confirmed
# Reset-KrbtgtPassword -DomainName "domain.local"

Phase 3: Evidence Collection

Forensic Evidence Preservation

Evidence Collection Priority:

Priority	Evidence Type	Volatility
1	Memory (RAM)	Very High
2	Running processes	Very High
3	Network connections	High
4	Logs (Security, System)	Medium
5	Disk image	Low
6	Ransom notes, encrypted files	Low

Memory Acquisition:

# Using WinPMEM (download from GitHub)
.\winpmem_mini_x64.exe memory.raw
 
# Using DumpIt
.\DumpIt.exe
 
# Output location: Document and preserve chain of custody

Collect Volatile Data:

# Create collection directory
$collectionPath = "C:\IR-Collection-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $collectionPath
 
# Running processes
Get-Process | Select-Object Id, ProcessName, Path, StartTime |
Export-Csv "$collectionPath\processes.csv" -NoTypeInformation
 
# Network connections
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess |
Export-Csv "$collectionPath\network-connections.csv" -NoTypeInformation
 
# DNS cache
Get-DnsClientCache | Export-Csv "$collectionPath\dns-cache.csv" -NoTypeInformation
 
# Scheduled tasks
Get-ScheduledTask | Export-Csv "$collectionPath\scheduled-tasks.csv" -NoTypeInformation
 
# Services
Get-Service | Select-Object Name, DisplayName, Status, StartType |
Export-Csv "$collectionPath\services.csv" -NoTypeInformation
 
# Recent file modifications
Get-ChildItem -Path "C:\" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) } |
Export-Csv "$collectionPath\recent-files.csv" -NoTypeInformation

Export Windows Event Logs:

# Security log
wevtutil epl Security "$collectionPath\Security.evtx"
 
# System log
wevtutil epl System "$collectionPath\System.evtx"
 
# PowerShell logs
wevtutil epl "Microsoft-Windows-PowerShell/Operational" "$collectionPath\PowerShell.evtx"
 
# Defender logs
wevtutil epl "Microsoft-Windows-Windows Defender/Operational" "$collectionPath\Defender.evtx"

Timeline Analysis

Key Events to Identify:

Event	Windows Event ID	Significance
Logon	4624	Initial access point
Failed logon	4625	Brute force attempts
Process creation	4688	Malware execution
Service installed	7045	Persistence mechanism
RDP connection	1149	Lateral movement
SMB share access	5140	Data access
Scheduled task	4698	Persistence
PowerShell execution	4104	Script execution

Query Security Logs:

# Find initial access (Type 10 = Remote RDP, Type 3 = Network)
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4624
} -MaxEvents 1000 |
Where-Object { $_.Properties[8].Value -in @(3, 10) } |
Select-Object TimeCreated,
    @{N='Account'; E={$_.Properties[5].Value}},
    @{N='LogonType'; E={$_.Properties[8].Value}},
    @{N='SourceIP'; E={$_.Properties[18].Value}}
 
# Find process creation events
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4688
} -MaxEvents 500 |
Select-Object TimeCreated,
    @{N='Process'; E={$_.Properties[5].Value}},
    @{N='CommandLine'; E={$_.Properties[8].Value}}

Phase 4: Eradication

Remove Ransomware Artifacts

Identify Persistence Mechanisms:

# Check Run keys
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
 
# Check scheduled tasks
Get-ScheduledTask | Where-Object { $_.State -eq "Ready" } |
Select-Object TaskName, TaskPath, @{N='Actions'; E={$_.Actions.Execute}}
 
# Check services
Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike "*Windows*" } |
Select-Object Name, PathName, StartMode
 
# Check startup folder
Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"

Remove Persistence:

# Remove malicious scheduled task
Unregister-ScheduledTask -TaskName "<malicious-task>" -Confirm:$false
 
# Remove malicious service
Stop-Service -Name "<malicious-service>" -Force
sc.exe delete "<malicious-service>"
 
# Remove registry persistence
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "<malicious-entry>"
 
# Delete malicious files (after forensic collection)
Remove-Item -Path "<malicious-file-path>" -Force

Clean with EDR:

Run full system scan
Review and remediate all detections
Verify no active threats remain
Check for dormant/scheduled malware

Validate Clean State

Verification Checklist:

□ No malicious processes running
□ No suspicious network connections
□ No persistence mechanisms remain
□ EDR shows clean status
□ AV scan completes with no detections
□ Startup items verified clean
□ Scheduled tasks reviewed
□ Services reviewed
□ User accounts audited

Phase 5: Recovery

Recovery Priority

Recovery Order:

Priority	Systems	Justification
1	Domain Controllers	Authentication required for all systems
2	DNS/DHCP	Network services
3	Backup Infrastructure	Required for restoration
4	Critical Business Systems	Revenue/operations
5	File Servers	User data access
6	End User Workstations	Employee productivity

Restore from Backup

Pre-Restoration Checks:

□ Backup integrity verified (not encrypted)
□ Backup predates infection (check timeline)
□ Clean environment ready for restoration
□ Network isolation maintained during restore
□ Credentials reset for restored systems

Restoration Process:

Verify backup integrity

# Veeam - Check backup job status
Get-VBRBackup | Where-Object { $_.JobType -eq "Backup" } |
Select-Object Name, LastResult, LastPointCreationTime
 
# Azure Backup - List recovery points
az backup recoverypoint list --resource-group <RG> --vault-name <Vault> --container-name <Container> --item-name <Item>

Restore to isolated network

- Create isolated VLAN for restoration
- No connection to production network
- Verify restored system is clean
- Run full security scan
- Check for persistence

Validate before reconnection

# Verify no malicious files
Get-ChildItem -Path "C:\" -Recurse -Include "*.exe", "*.dll" -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt $infectionDate } |
Select-Object FullName, LastWriteTime
 
# Verify no scheduled tasks
Get-ScheduledTask | Where-Object { $_.Date -gt $infectionDate }
 
# Verify services
Get-Service | Where-Object { $_.Status -eq "Running" -and $_.StartType -eq "Automatic" }

Password Reset Strategy

Critical Password Resets:

Account Type	Action	Priority
Domain Admin	Reset immediately	Critical
Service Accounts	Reset and update services	Critical
KRBTGT	Reset twice (10+ hours apart)	High
All privileged accounts	Reset before reconnection	High
All user accounts	Force password change at logon	Medium

# Force password change for all users
Get-ADUser -Filter * | Set-ADUser -ChangePasswordAtLogon $true
 
# Reset specific privileged account
Set-ADAccountPassword -Identity "admin-account" -Reset -NewPassword (Read-Host -AsSecureString "New Password")

Phase 6: Post-Incident Activities

Lessons Learned

Post-Incident Review Meeting:

Topic	Questions to Address
Detection	How was the incident detected? Could we detect earlier?
Response	What went well? What could be improved?
Containment	Was containment effective? How fast?
Communication	Were stakeholders informed appropriately?
Tools	Did our tools perform as expected?
Training	What training gaps were identified?

Documentation Requirements:

1. Incident Timeline
   - Initial detection time
   - Key response actions with timestamps
   - Recovery completion time
   - Total incident duration
 
2. Technical Analysis
   - Attack vector (how did they get in?)
   - Ransomware variant and behavior
   - Systems affected
   - Data potentially exfiltrated
 
3. Business Impact
   - Downtime duration
   - Systems affected
   - Data loss (if any)
   - Financial impact estimate
 
4. Recommendations
   - Security improvements needed
   - Process improvements
   - Training needs
   - Tool enhancements

Improve Defenses

Common Ransomware Attack Vectors:

Vector	Mitigation
Phishing email	Email filtering, user training, DMARC
RDP exposure	MFA, VPN-only access, network segmentation
Vulnerable software	Patch management, vulnerability scanning
Compromised credentials	MFA, privileged access management, credential monitoring
Supply chain	Vendor assessment, software allowlisting

Recommended Improvements:

□ Implement/improve backup strategy (3-2-1 rule, air-gapped)
□ Enable MFA on all privileged accounts
□ Deploy EDR with ransomware protection
□ Implement network segmentation
□ Enable PowerShell logging and constraints
□ Improve email filtering and user training
□ Establish incident response retainer
□ Conduct regular IR tabletop exercises

Communication Templates

Internal Notification

SUBJECT: [SECURITY INCIDENT] Ransomware Detected - ACTION REQUIRED
 
Priority: CRITICAL
Time: [TIMESTAMP]
Incident ID: [IR-YYYY-###]
 
SITUATION:
We have detected ransomware activity affecting [SCOPE]. The Incident Response team is actively responding.
 
IMMEDIATE ACTIONS:
1. Do NOT attempt to access affected systems
2. Do NOT open suspicious emails or attachments
3. Report any unusual system behavior immediately
4. [Additional specific instructions]
 
CURRENT STATUS:
- Affected systems have been isolated
- Investigation is ongoing
- Backup integrity is being verified
 
NEXT UPDATE: [TIME]
 
Contact: [IR Team Contact]

Executive Brief

EXECUTIVE INCIDENT BRIEF
Incident: Ransomware Attack
Date: [DATE]
Status: [Active Response / Contained / Recovered]
 
SUMMARY:
[Brief description of incident, scope, and current status]
 
IMPACT:
- Systems Affected: [COUNT/LIST]
- Business Functions Impacted: [LIST]
- Estimated Downtime: [DURATION]
- Data at Risk: [ASSESSMENT]
 
RESPONSE STATUS:
- Containment: [Complete/In Progress]
- Eradication: [Complete/In Progress]
- Recovery: [Complete/In Progress/Pending]
 
NEXT STEPS:
1. [Action item]
2. [Action item]
3. [Action item]
 
ESTIMATED RECOVERY: [TIMEFRAME]

Quick Reference

Critical Contact List

Role	Contact	Responsibility
IR Lead	[Name/Phone]	Overall incident command
IT Operations	[Name/Phone]	System isolation and recovery
Security Team	[Name/Phone]	Investigation and analysis
Legal/Compliance	[Name/Phone]	Regulatory requirements
Communications	[Name/Phone]	Internal/external messaging
Executive Sponsor	[Name/Phone]	Business decisions
External IR Firm	[Name/Phone]	Additional support if needed
Cyber Insurance	[Policy #/Phone]	Claim notification
Law Enforcement	FBI IC3/Local	Reporting if required

Decision Tree

RANSOMWARE DETECTED
        │
        ▼
Is attack active (spreading)?
    │           │
   YES          NO
    │           │
    ▼           ▼
ISOLATE       Assess scope
IMMEDIATELY   and impact
    │           │
    ▼           ▼
Preserve      Collect
evidence      evidence
    │           │
    └─────┬─────┘
          ▼
    Can we recover
    from backup?
    │           │
   YES          NO
    │           │
    ▼           ▼
Proceed to    Consider
recovery      options*
    │           │
    ▼           ▼
Reset all     Engage legal,
credentials   insurance, IR firm

*Options may include negotiation as last resort - always involve legal and insurance.

Verification Checklist

Incident Closed Criteria:

References

Last Updated: February 2026

Prerequisites

Overview

Phase 1: Detection and Identification

Initial Detection Sources

Ransomware Identification

Phase 2: Containment

Immediate Containment Actions

Contain Lateral Movement

Phase 3: Evidence Collection

Forensic Evidence Preservation

Timeline Analysis

Phase 4: Eradication

Remove Ransomware Artifacts

Validate Clean State

Phase 5: Recovery

Recovery Priority

Restore from Backup

Password Reset Strategy

Phase 6: Post-Incident Activities

Lessons Learned

Improve Defenses

Communication Templates

Internal Notification

Executive Brief

Quick Reference

Critical Contact List

Decision Tree

Verification Checklist

References

Prerequisites

Overview

Phase 1: Detection and Identification

Initial Detection Sources

Ransomware Identification

Phase 2: Containment

Immediate Containment Actions

Contain Lateral Movement

Phase 3: Evidence Collection

Forensic Evidence Preservation

Timeline Analysis

Phase 4: Eradication

Remove Ransomware Artifacts

Validate Clean State

Phase 5: Recovery

Recovery Priority

Restore from Backup

Password Reset Strategy

Phase 6: Post-Incident Activities

Lessons Learned

Improve Defenses

Communication Templates

Internal Notification

Executive Brief

Quick Reference

Critical Contact List

Decision Tree

Verification Checklist

References