Ransomware Response

What This Playbook Covers

• This playbook handles the first 60 minutes between the moment ransomware is confirmed (encrypted files, ransom note present, or encryption in progress) and the initial containment decision.
• It does not replace a full incident response plan — it is the immediate-response checklist for the SOC analyst or first responder who gets the call before the IR team is assembled.
• MITRE ATT&CK maps the impact phase to T1486 (Data Encrypted for Impact).

Phase 0: Triage — Confirm It Is Ransomware (0-5 minutes)

Before executing any response actions, confirm you are dealing with ransomware:

SPL query — detect mass file encryption via Sysmon Event ID 11 (run in Splunk):

index=windows sourcetype=WinEventLog:Sysmon EventCode=11
| stats count by Computer, Image, TargetFilename, bin(_time, 60s)
| where count > 100
| eval alert = "CRITICAL — " . count . " file modifications in 60 seconds by " . Image . " — possible ransomware encryption in progress"
| table _time, Computer, Image, count, TargetFilename, alert
| sort - count

SPL query — detect file rename storm (Sysmon Event ID 11 with rename):

index=windows sourcetype=WinEventLog:Sysmon EventCode=11
| search TargetFilename="*.*.encrypt" OR TargetFilename="*.*.locked" OR TargetFilename="*.*.crypt" OR TargetFilename="*.*.lockbit" OR TargetFilename="*.*.blackcat" OR TargetFilename="*.*.ako"
| stats count by Computer, Image, bin(_time, 30s)
| where count > 20
| eval alert = "CRITICAL — mass file renaming by " . Image . " — ransomware likely"
| table _time, Computer, Image, count, alert

Phase 1: Immediate Isolation (5-15 minutes)

Do NOT shut down affected systems. Shutting down destroys volatile evidence (memory, running processes, network connections) and may trigger additional encryption behavior on reboot.

Checklist — Short-Term Isolation

• Isolate the affected host — disable the network interface or block switch port. Do not use shutdown.
• Block outbound C2 at the firewall — if the ransomware variant is known, block its known C2 domains/IPs. If unknown, temporarily block all outbound traffic from the affected network segment.
• Disconnect network shares — prevent the encryptor from reaching mapped drives. The attacker may have already poisoned the network share with a scheduled encryption job.
• Isolate other hosts that are communicating with the affected host. Check Sysmon Event ID 3 (network connections) for lateral movement indicators.
• Disable the affected user’s AD account — the credentials used at the time of compromise may be compromised.

What NOT to Do

Phase 2: Variant Identification (15-25 minutes)

Knowing the ransomware family tells you whether decryption is possible, whether data exfiltration was involved, and what containment steps are known to work.

Quick Identification Checklist

Variant-Specific Checks

SPL query — identify variant by ransom note filename:

index=windows sourcetype=WinEventLog:Sysmon EventCode=11
| search TargetFilename IN ("*README*.txt", "*HOW_TO_DECRYPT*", "*RECOVER*", "*DECRYPT*", "*README*.hta", "*HELP_YOUR_FILES*", "*DECRYPT_INFO*", "*RESTORE*")
| stats count by Computer, TargetFilename
| table _time, Computer, TargetFilename, count

Phase 3: Evidence Preservation (25-35 minutes)

What to Capture Before Cleanup

Phase 4: Backup Assessment and Recovery Options (35-45 minutes)

Backup Verification Commands

# Check for volume shadow copies
vssadmin list shadows
vssadmin list providers

# Check if shadow copies were deleted
vssadmin list shadows
# If empty or different volume, attacker deleted them (common ransomware behavior)

SPL query — detect volume shadow copy deletion:

index=windows sourcetype=WinEventLog:System EventCode=33 OR EventCode=32
| search EventID IN (33, 32)
| eval alert = "CRITICAL — Volume Shadow Copy deleted — ransomware or intentional evidence destruction"
| table _time, Computer, EventCode, Message

Phase 5: Escalation and Decision (45-60 minutes)

Escalation Thresholds

Decision Matrix

Related

• Ransomware Fundamentals — covers the ransomware fundamentals concepts
• Ransomware — detection and response for T1486 techniques
• Kill Chain — covers the kill chain concepts
• Active Directory Compromise Response — detection and response for T1558 techniques
• Business Email Compromise Response — detection and response for T1566, T1114, T1098, T1586 techniques

Sources

• CISA StopRansomware Guide
• NIST SP 800-61 Rev 2 — Incident Handling
• MITRE ATT&CK T1486
• Microsoft — Ransomware Detection and Response
• The No More Ransom Project