<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ransomware-response
description: >-
  Handles ransomware incidents including containment, variant identification,
  decryption assessment, negotiation considerations, and recovery procedures.
domain: cybersecurity
subdomain: incident-response
tags:
  - ransomware
  - encryption
  - decryption
  - ransom-negotiation
  - backup-recovery
  - data-recovery
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Performing Ransomware Response

## Overview

Ransomware response requires rapid containment to prevent encryption spread,
identification of the ransomware variant for potential decryption, evidence
preservation for law enforcement, and coordinated recovery from backups. The
first 30 minutes determine whether the organization loses days or months of data.

Key principle: NEVER pay ransom without exhausting all other options — payment
funds criminal operations and provides no guarantee of decryption.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| ID Ransomware | Variant identification | https://id-ransomware.malwarehunterteam.com |
| No More Ransom | Free decryptors | https://nomoreransom.org |
| CrowdStrike/EDR | Endpoint isolation | Platform-specific |
| Backup system | Recovery source | Veeam / Commvault / cloud |
| Chainsaw | Pre-ransomware IOC hunting | GitHub release |
| YARA | Ransomware indicator scanning | `pip install yara-python` |

## Key Concepts

### Ransomware Kill Chain

1. **Initial access** — Phishing, RDP brute-force, exploit
2. **Execution** — Loader deployment, C2 establishment
3. **Privilege escalation** — Local admin, domain admin
4. **Lateral movement** — PsExec, WMI, RDP, SMB
5. **Discovery** — Network shares, backup locations, domain structure
6. **Collection** — Data staging for double extortion
7. **Exfiltration** — Data theft before encryption
8. **Impact** — Encryption deployment, ransom note delivery

### Pre-Ransomware Indicators

Detect BEFORE encryption begins:

| Indicator | Detection |
|-----------|-----------|
| Reconnaissance tools (AdFind, BloodHound) | Process creation logs |
| RDP to multiple hosts | Event ID 4624 Type 10 |
| PsExec/WMIC lateral movement | Event ID 7045, Sysmon ID 1 |
| Volume shadow copy deletion | `vssadmin delete shadows` |
| Backup deletion/corruption | Backup system alerts |
| Large data staging | Unusual archive creation |
| Cobalt Strike beacons | Network anomaly detection |

### Decryption Assessment

1. Identify variant from ransom note, file extension, encrypted file header
2. Check No More Ransom (nomoreransom.org) for free decryptors
3. Check ID Ransomware for variant identification
4. Assess if encryption implementation has known flaws
5. Contact law enforcement — they may have seized decryption keys

## Workflow

### Step 1 — Immediate Containment (First 15 Minutes)

```bash
# Isolate ALL endpoints via EDR — not just confirmed infected
# CrowdStrike bulk contain
for DEVICE_ID in $(cat /evidence/affected_devices.txt); do
  curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
    -H "Authorization: Bearer $CS_TOKEN" \
    -d "{\"ids\":[\"$DEVICE_ID\"]}"
done

# Block C2 at network perimeter
iptables -I FORWARD -d $C2_IP -j DROP

# Disable compromised accounts
powershell -Command "Get-ADUser -Filter {Enabled -eq \$true} | Where-Object {
  \$_.LastLogonDate -gt (Get-Date).AddHours(-24)
}" # Review before bulk disable

# Disconnect network shares to stop encryption spread
net use * /delete /yes
```

### Step 2 — Identify Ransomware Variant

```bash
# Collect ransom note
cp /path/to/RANSOM_NOTE.txt /evidence/

# Collect sample encrypted file + original (if available)
cp /path/to/encrypted_file.locked /evidence/
cp /path/to/known_original /evidence/

# Check file extension pattern
find / -name "*.locked" -o -name "*.encrypted" -o -name "*.crypt" 2>/dev/null | head -20

# Upload to ID Ransomware (manual — web interface)
# Check No More Ransom for free decryptor

# Hash ransomware binary if found
sha256sum /path/to/ransomware_binary
# Check VirusTotal for variant identification
```

### Step 3 — Assess Encryption Scope

```bash
# Count encrypted files
find / -name "*.locked" 2>/dev/null | wc -l

# Identify affected shares
find /mnt /srv /data -name "*RANSOM*" -o -name "*README*" 2>/dev/null

# Check if backups are affected
ls -la /backup/ /mnt/backup/ 2>/dev/null

# Check Volume Shadow Copies (Windows)
vssadmin list shadows
```

### Step 4 — Evidence Preservation

```bash
# Preserve ransomware binary
cp /path/to/malware /evidence/ransomware_sample
sha256sum /evidence/ransomware_sample > /evidence/ransomware_sample.sha256

# Preserve ransom note and encrypted samples
# Capture memory BEFORE reboot (may contain encryption keys)
avml /evidence/memory.lime

# Preserve event logs for timeline
hayabusa csv-timeline -d /path/to/evtx/ -o /evidence/timeline.csv
```

### Step 5 — Recovery

```bash
# Verify backup integrity BEFORE restoration
sha256sum /backup/latest/*

# Restore from clean backup (verify backup predates compromise)
# Check backup date vs. estimated initial access date

# Rebuild from gold image if no clean backup
# Apply patches for initial access vector BEFORE reconnecting

# Restore data from verified clean backup
rsync -av /backup/verified/ /restored/
```

### Step 6 — Post-Recovery Hardening

```bash
# Patch initial access vector
# Enable MFA on all remote access
# Segment backup networks
# Deploy canary files for early detection
# Update EDR policies
# Conduct tabletop exercise for ransomware scenario
```

## Detection

```yaml
title: Ransomware Response Detection
id: 06c6cb11-9e16-4ee1-a6e6-b37af94fc046
status: experimental
description: Detects suspicious activity related to performing ransomware response techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*ransomware*"
  condition: selection
level: high
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] All endpoints isolated within 15 minutes of detection
- [ ] Ransomware variant identified via ID Ransomware or analysis
- [ ] Free decryptor availability checked (No More Ransom)
- [ ] Law enforcement notified (FBI IC3, local CERT)
- [ ] Evidence preserved (binary, ransom note, encrypted samples, memory)
- [ ] Encryption scope assessed (files, shares, backups)
- [ ] Recovery from verified clean backups
- [ ] Initial access vector identified and patched
- [ ] Credentials rotated across the environment
- [ ] After-action report completed with detection gaps

## References

- CISA Ransomware Guide: https://www.cisa.gov/ransomware-guide
- No More Ransom: https://nomoreransom.org
- ID Ransomware: https://id-ransomware.malwarehunterteam.com
- NIST SP 1800-26: Data Integrity — Detecting and Responding to Ransomware
- MITRE ATT&CK T1486: Data Encrypted for Impact
