← All cheat sheets

RANSOMWARE TRIAGE

Plain-text reference · 6 KB. Read it, search it (Ctrl-F) or print it.

First-hour SOC playbook for a suspected or confirmed ransomware event. Goal:
contain spread, preserve evidence, and scope the blast radius WITHOUT
destroying forensic data. Follow your IR plan and escalation path; this is
operational guidance, not legal advice.

GOLDEN RULES#

- ISOLATE, do not power off. Pulling power destroys RAM (keys, injected code)
  and can corrupt disks mid-encryption. Use network isolation instead.
- Do NOT delete or reboot encrypted hosts you still need to analyse.
- Do NOT pay or negotiate anything without exec + legal + insurer sign-off.
- Start a timeline (UTC) and an action log immediately; record who/what/when.
- Assume data theft (double extortion) until proven otherwise.

MINUTE 0-15: DETECT & DECLARE#

[ ] Confirm it is ransomware: mass file renames/extensions, ransom notes
    (readme/how-to-decrypt .txt/.html in many folders), spiking file writes,
    users locked out of files, shadow copies deleted.
[ ] Declare an incident; assign IR lead; open the incident channel
    (OUT-OF-BAND -- assume email/AD/Teams may be compromised).
[ ] Record first evidence + time (UTC). Note the ransom note filename and the
    appended file extension (useful IOC / family identification).
[ ] Notify per plan: IR lead, management, legal, DPO, cyber-insurer,
    external DFIR retainer.

MINUTE 15-45: CONTAIN (stop the spread)#

[ ] Isolate affected hosts at the network: EDR "isolate/contain", disable
    the switch port, or VLAN quarantine. Keep the host powered ON.
[ ] If spread is active and fast, consider segment-level containment:
    block SMB (445), RDP (3389), WinRM (5985/5986) between segments; disable
    affected VLAN interdomain routing.
[ ] Disable compromised/suspected accounts; revoke sessions, tokens, and
    especially any domain-admin / service accounts in use.
[ ] Protect the "crown jewels": isolate Domain Controllers, backup servers,
    and hypervisors FIRST if not already hit -- ransomware targets backups.
[ ] Verify backups are intact and OFFLINE/immutable; do NOT mount production
    backups onto an infected network.
[ ] Block known-bad hashes/IPs/domains (ransom-note C2, exfil endpoints) at
    EDR/firewall/proxy/DNS.

EVIDENCE TO PRESERVE (before changing anything)#

Order of volatility (collect top-down):
[ ] Memory image of representative infected host(s) -- keys/injected code
    may only exist in RAM.
[ ] Network state: active connections (ss/netstat), ARP, routing, DNS cache.
[ ] Running processes + loaded modules + open handles.
[ ] Disk image or forensic triage collection (KAPE/Velociraptor) of a
    representative host.
[ ] Copies of: a ransom note, several encrypted sample files (with their
    original unencrypted counterparts if any survive in backups -- useful to
    identify the family / possible decryptor).
[ ] Logs: EDR, Windows Security/System/Sysmon, firewall, proxy, VPN, email,
    DC authentication logs, backup-server logs.
Hash everything (sha256), keep an untouched master, work on copies, maintain
chain of custody.

TELEMETRY TO PULL (scoping the blast radius)#

[ ] Patient zero: earliest host showing encryption; trace back to entry.
[ ] Initial access vector: phishing email, exposed RDP/VPN, exploited
    public app, valid-account abuse? (check email gateway, VPN/RDP logs,
    vuln on perimeter).
[ ] Lateral movement: Security 4624/4648 (types 3/10), 4672; new services
    (7045/4697); scheduled tasks (4698); RDP/SMB/WinRM/WMI usage; PsExec-like
    activity; admin-share access (5140/5145).
[ ] Credential theft: LSASS access (Sysmon 10 to lsass.exe), 4768/4769
    Kerberos anomalies, NTDS access on DCs.
[ ] Defense tampering: Defender disabled, logs cleared (Security 1102,
    System 104), shadow copies deleted (vssadmin/wmic usage), boot recovery
    disabled.
[ ] Exfiltration: large outbound transfers, cloud-storage/anon-share uploads,
    archiving tools (rar/7z), unusual data staging.
[ ] Full scope: query EDR/SIEM for the ransom extension, note filename, and
    IOCs across ALL hosts -- list every affected and every at-risk system.

IDENTIFY THE FAMILY (helps decisions)#

[ ] Note the appended extension and ransom-note name/text.
[ ] Submit a sample / note to reputable ID services (e.g. ID Ransomware,
    No More Ransom) and threat intel -- a free decryptor may exist.
[ ] Map observed behavior to known group TTPs (ATT&CK) to anticipate next
    moves (e.g. backup deletion, exfil).
Do NOT upload confidential documents; use the ransom note / sample / hash.

DO / DON'T (first hour)#

DO   isolate (not wipe), keep hosts powered on, capture memory first, use
     out-of-band comms, protect DCs/backups/hypervisors, start the timeline,
     loop in legal/insurer early, assume exfiltration.
DON'T power off or reimage hosts you still need, run cleanup/AV "remove" on
     evidence before imaging, mount production backups on the infected
     network, pay/negotiate without sign-off, communicate externally before
     comms/legal approve, or trust a compromised AD/email for coordination.

AFTER CONTAINMENT (hand-off to recovery)#

- Eradicate persistence and close the entry vector before restoring.
- Rebuild from trusted media where trust is uncertain; rotate ALL potentially
  exposed credentials (domain-wide if identity infra was touched).
- Restore from verified clean, offline backups in staged waves with
  heightened monitoring for re-infection.
- Regulatory clocks (know yours): e.g. GDPR 72h breach notification if
  personal data is affected; NIS2/DORA timelines for in-scope entities.
  Confirm exact obligations with legal/DPO.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.