Performing Ransomware Incident Response Skill

Performing Ransomware Incident Response

When to Use

Ransomware encryption detected on one or more endpoints
Ransom note files discovered on file shares or endpoints
File extensions changed to known ransomware variants (.locked, .encrypted, .ryuk, etc.)
Volume Shadow Copies deleted or backup systems targeted
EDR/AV alerts for known ransomware families (LockBit, BlackCat/ALPHV, Cl0p, Royal, Play)

Prerequisites

Incident Response Plan with ransomware-specific playbook
Offline/immutable backup infrastructure
EDR platform with ransomware rollback capability
No Ransom (nomoreransom.org) decryptor database access
Network segmentation capability for rapid isolation
Communication plan for stakeholders and potentially law enforcement

Workflow

Step 1: Detect and Confirm Ransomware

# Check for ransom note files across file shares
find /mnt/shares -name "README*.txt" -o -name "DECRYPT*.txt" -o -name "HOW_TO_RECOVER*" \
  -o -name "RESTORE_FILES*" -newer /tmp/baseline_timestamp 2>/dev/null

# Check for mass file encryption indicators
find /mnt/shares -name "*.encrypted" -o -name "*.locked" -o -name "*.BlackCat" \
  -o -name "*.lockbit" -mmin -60 2>/dev/null | head -50

# Identify ransomware variant from ransom note
strings ransom_note.txt | grep -iE "(bitcoin|wallet|tor|onion|decrypt|payment)"

# Upload sample to ID Ransomware for variant identification
curl -X POST "https://id-ransomware.malwarehunterteam.com/api/upload" \
  -F "ransom_note=@ransom_note.txt" -F "encrypted_file=@sample.encrypted"

Step 2: Isolate Infected Systems Immediately

# CrowdStrike Falcon - Mass contain infected hosts
for device_id in $(cat infected_device_ids.txt); do
  curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
    -H "Authorization: Bearer $FALCON_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"ids\": [\"$device_id\"]}"
done

# Block known ransomware C2 IPs at firewall
while read ip; do
  iptables -A INPUT -s "$ip" -j DROP
  iptables -A OUTPUT -d "$ip" -j DROP
done < ransomware_c2_ips.txt

# Disable SMB/lateral movement protocols between segments
# Palo Alto firewall
set rulebase security rules block-smb-lateral from internal to internal application ms-ds-smb action deny
commit force

Step 3: Assess Encryption Scope and Impact

# Splunk query - identify affected hosts by file modification patterns
index=endpoint sourcetype=sysmon EventCode=11
| stats dc(TargetFilename) as files_created by Computer
| where files_created > 1000
| sort -files_created

# Check if Volume Shadow Copies were deleted
wevtutil qe Application /q:"*[System[Provider[@Name='VSS']]]" /f:text /c:20

# Check backup integrity
veeam-backup-check --repository "primary_backup" --verify-integrity
restic -r /backup/repo check --read-data-subset=1/10

Step 4: Check for Available Decryptors

# Check No More Ransom project for free decryptors
# https://www.nomoreransom.org/en/decryption-tools.html

# Check Kaspersky decryptor database
# https://noransom.kaspersky.com/

# Check Emsisoft decryptor database
# https://www.emsisoft.com/en/ransomware-decryption/

# Test if files can be recovered from shadow copies (if not deleted)
vssadmin list shadows
mklink /D C:\ShadowCopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Check previous file versions
wmic shadowcopy list brief

Step 5: Eradicate Ransomware and Persistence

# Scan all systems for ransomware artifacts
yara -r ransomware_rules.yar /mnt/infected_disk/

# Check common persistence locations
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
schtasks /query /fo CSV /v | findstr /i "encrypt lock ransom"

# Check for ransomware loader in Group Policy
find /mnt/sysvol -name "*.exe" -o -name "*.dll" -o -name "*.bat" -newer /tmp/baseline

# Remove ransomware artifacts
# After forensic imaging is complete
Get-ChildItem -Path C:\ -Include *.encrypted,*.locked -Recurse | Remove-Item -Force
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "malicious_entry" /f

Step 6: Recover Systems from Clean Backups

# Verify backup integrity before restoration
sha256sum backup_image_server01.vhdx
restic -r /backup/repo restore latest --target /mnt/restore --verify

# Restore from Veeam backup
# Veeam PowerShell
Start-VBRRestoreSession -BackupObject (Get-VBRBackup -Name "Server01_Backup") \
  -RestorePoint (Get-VBRRestorePoint -Backup "Server01_Backup" | Sort-Object -Property CreationTime -Descending | Select-Object -First 1)

# Rebuild from golden images if backups compromised
packer build -var "os_version=2022" golden_image.pkr.hcl
terraform apply -var="image_id=ami-golden-2024" -auto-approve

Step 7: Post-Recovery Validation

# Verify no ransomware persistence remains
Get-CimInstance -ClassName Win32_StartupCommand | Select-Object Name, Command, Location
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} | Select-Object TaskName, TaskPath

# Verify file integrity post-restore
fciv -r C:\restored_data\ -sha256 > post_restore_hashes.txt
diff pre_infection_hashes.txt post_restore_hashes.txt

# Enhanced monitoring for re-infection
# Deploy canary files in sensitive directories
for dir in /mnt/shares/*/; do
  echo "CANARY_$(date +%s)" > "$dir/.canary_monitor.txt"
done

Key Concepts

| Concept | Description | |---------|-------------| | Double Extortion | Attacker encrypts data AND exfiltrates it, threatening public release | | Triple Extortion | Adding DDoS threats or contacting victims' customers to increase pressure | | Ransomware-as-a-Service (RaaS) | Criminal business model where affiliates pay operators for ransomware tools | | Decryptor Availability | Free decryptors may exist for some ransomware families via No More Ransom | | Immutable Backups | Backup copies that cannot be modified or deleted, critical for ransomware recovery | | Dwell Time | Time between initial compromise and ransomware deployment (often weeks) | | IOC Sharing | Sharing indicators with ISACs and law enforcement improves collective defense |

Tools & Systems

| Tool | Purpose | |------|---------| | ID Ransomware | Identify ransomware variant from samples | | No More Ransom | Free decryptor database (nomoreransom.org) | | CrowdStrike Falcon | Endpoint containment and ransomware rollback | | Veeam/Commvault | Backup verification and restoration | | YARA | Ransomware artifact scanning | | Volatility | Memory forensics for ransomware analysis | | Splunk/Elastic | Log analysis for encryption scope assessment |

Common Scenarios

LockBit 3.0 Enterprise Attack: Attacker compromises VPN, deploys LockBit across domain via GPO. Isolate domain controllers first, verify backup integrity, restore from immutable backups.
BlackCat/ALPHV Double Extortion: Data exfiltrated before encryption. Engage legal for breach notification, restore from backups, negotiate through authorized channels if needed.
Cl0p MOVEit Exploitation: Mass exploitation of file transfer application. Patch vulnerability, identify exfiltrated data, rebuild affected systems.
Targeted Healthcare Ransomware: Patient data encrypted. Activate emergency manual procedures, engage HHS, prioritize clinical system recovery.
Ransomware via Compromised MSP: Attacker accesses multiple clients through MSP tools. Disconnect MSP access, contain per-client, coordinate multi-tenant response.

Output Format

Ransomware variant identification report
Encryption scope assessment with affected systems list
Backup integrity verification results
Recovery timeline and prioritized restoration plan
Eradication verification report
Lessons learned document with prevention recommendations

Agent Skills: Performing Ransomware Incident Response

Install this agent skill to your local

Skill Files