Incident Response Playbook: Ransomware Edition

Ransomware: The Modern Business Continuity Crisis

Ransomware is no longer primarily a technical problem — it is a business continuity crisis that demands a coordinated response across IT, security, legal, communications, and executive leadership. Organisations that treat it as purely technical consistently fare worse in recovery.

This playbook reflects lessons learned from ransomware incidents across multiple sectors, including financial services, healthcare, and manufacturing.

Phase 1: Detection and Analysis (0–2 Hours)

Initial Indicators

Ransomware typically announces itself, but early indicators often appear hours or days before encryption begins:

• Unusual volume of file modifications (shadow copy deletion, file renaming)
• Legitimate tools (cobalt Strike, Mimikatz, rclone) executing from unusual locations
• New administrator accounts created outside change management
• Abnormal outbound data volumes (pre-encryption exfiltration)
• Lateral movement via SMB or WMI across multiple hosts

Immediate Actions

1. Isolate, do not power off — Preserve volatile memory and running process information
2. Identify Patient Zero — Check Event ID 4624/4625 for unusual authentications
3. Scope the blast radius — Map which systems are encrypted vs. still clean
4. Preserve evidence — Capture memory dumps, event logs, and network captures before remediation
5. Activate incident response team — Invoke your IR retainer if external support is needed

KQL Query for Initial Scoping

// Detect mass file modification (ransomware behaviour)
DeviceFileEvents
| where TimeGenerated > ago(1h)
| where ActionType in ("FileModified", "FileRenamed")
| summarize FileCount = count() by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 5m)
| where FileCount > 500
| order by FileCount desc

Phase 2: Containment (2–6 Hours)

Network Isolation

• Isolate affected hosts via Defender for Endpoint network isolation or VLAN changes
• Block C2 communication by identifying and blocking outbound connections
• Disable compromised accounts immediately — do not just reset passwords
• Revoke active sessions in Azure AD for compromised accounts

Do Not Negotiate — Yet

Ransom negotiation, if it occurs, should be handled by specialist advisors (legal and breach coaches), not technical staff. Focus the first six hours entirely on containment and evidence preservation.

Critical: Check Backup Integrity

Attackers frequently target backup infrastructure before triggering encryption. Immediately:

• Verify backup systems are online and uncorrupted
• Check backup job logs for the previous 48–72 hours
• Identify the latest known-good backup point
• Take offline copies of backup data if cloud-connected backups are at risk

Phase 3: Eradication (6–48 Hours)

Root Cause Analysis

Identify the initial access vector before rebuilding anything. Common vectors:

• Phishing — Check email gateway logs for suspicious attachments received 1–7 days prior
• RDP brute force — Review failed authentication events (Event ID 4625) on internet-facing systems
• Vulnerable VPN — Check patch levels on VPN appliances (Fortinet, Pulse Secure, Citrix)
• Compromised credentials — Check HaveIBeenPwned and review credential exposure

Full Environment Audit

• Audit all administrator accounts (local and domain)
• Review Group Policy Objects for malicious changes
• Check scheduled tasks and startup items on all systems
• Scan remaining systems for Cobalt Strike beacons and other persistence mechanisms

Rebuild vs. Restore Decision

For each affected system, decide:

• Restore from backup if backup integrity is confirmed and system criticality justifies it
• Rebuild from scratch if backup integrity is uncertain or system was compromised over extended period
• Document decisions with timestamps for post-incident review and regulatory reporting

Phase 4: Recovery (48 Hours–2 Weeks)

Phased Recovery

Prioritise systems in this order:

1. Identity infrastructure (Domain Controllers, Azure AD Connect)
2. Core business systems (ERP, payroll, customer-facing services)
3. Communication systems (email, collaboration)
4. Internal tooling and secondary systems

Hardening During Recovery

Do not restore systems to their pre-incident state. Implement improvements during recovery:

• Enable MFA on all accounts (no exceptions post-incident)
• Implement Conditional Access policies
• Disable unused protocols (SMBv1, RDP where not required)
• Patch all systems to current levels before reconnecting

Phase 5: Post-Incident Review

Within 30 days of full recovery, conduct a structured lessons-learned session:

• Timeline reconstruction — When did the attacker gain access vs. when were they detected?
• Detection gap analysis — What alerts should have fired but did not?
• Process gaps — Where did the incident response process break down?
• Regulatory obligations — Have all reporting requirements been met (ICO, PRA, etc.)?

Document findings and create a remediation roadmap with clear ownership and deadlines. Ransomware readiness exercises (tabletop simulations) should be conducted annually.