<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ransomware-recovery-procedures
description: >-
  Execute ransomware recovery from containment through full restoration.
  Covers evidence-preserving recovery, backup validation before restore,
  gold image rebuilds, credential rotation, network reconnection criteria,
  and post-recovery monitoring. Provides runbooks for Veeam, Commvault,
  cloud-native, and bare-metal recovery scenarios.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - ransomware-recovery
  - backup-restore
  - disaster-recovery
  - gold-image
  - credential-rotation
  - business-continuity
  - veeam
  - commvault
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1490"]
---

# Implementing Ransomware Recovery Procedures

## Overview

Recovery from ransomware requires a structured approach that preserves
evidence, validates backup integrity, rebuilds from known-good baselines,
and ensures the initial access vector is closed before reconnection.
Rushing recovery without validation leads to re-infection.

Critical sequence: Contain → Preserve → Validate → Rebuild → Restore → Harden → Monitor.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Veeam B&R | Enterprise backup/restore | Licensed install |
| Restic | Open-source restore | `apt install restic` |
| rsync | File synchronization | Built-in |
| Packer | Gold image building | `apt install packer` |
| Ansible | Configuration management | `pip install ansible` |
| ClamAV | Backup malware scan | `apt install clamav` |

## Key Concepts

### Recovery Priority Tiers

```
Tier 0 (Immediate — 0-4 hours):
├── Active Directory domain controllers
├── DNS / DHCP
├── Authentication services (RADIUS, LDAP)
└── Core network infrastructure

Tier 1 (Critical — 4-24 hours):
├── Email and communication systems
├── Critical business applications
├── Database servers
└── File servers (priority data)

Tier 2 (Important — 24-72 hours):
├── Secondary applications
├── Development environments
├── Non-critical file shares
└── Print servers

Tier 3 (Normal — 72+ hours):
├── Workstations (reimage from gold image)
├── Training systems
├── Archive systems
└── Non-essential services
```

### Recovery Decision Tree

```
Has backup? ─── No ──→ Free decryptor available? ─── No ──→ Rebuild from scratch
    │                       │
    Yes                     Yes
    │                       │
    ▼                       ▼
Backup clean? ──No──→ Scan & clean backup first
    │
    Yes
    │
    ▼
Backup within RPO? ──No──→ Accept data gap or supplement
    │
    Yes
    │
    ▼
Restore to isolated env → Validate → Reconnect
```

## Workflow

### Step 1 — Pre-Recovery Validation

```bash
# Verify containment is complete
# All affected systems isolated via EDR
# C2 domains/IPs blocked at perimeter
# Compromised accounts disabled

# Document initial access vector (MUST be patched before reconnection)
cat /case/findings/initial_access.txt

# Verify backup integrity before any restore
sha256sum /backup/latest/* > /case/recovery/pre-restore-hashes.txt

# Scan backup for malware before restoring
clamscan -r --infected --log=/case/recovery/clamav-scan.log /backup/latest/

# Verify backup predates compromise
stat /backup/latest/*.bak | grep -E "Modify|Birth"
# Compare against estimated initial access date
```

### Step 2 — Active Directory Recovery

```powershell
# AD recovery is highest priority — if AD is compromised, nothing is trusted

# Option A: Restore DC from pre-compromise backup
# Authoritative restore of AD database
ntdsutil
# activate instance ntds
# authoritative restore
# restore subtree "DC=domain,DC=com"

# Option B: Rebuild DC from gold image
# Fresh Windows Server install → dcpromo → restore AD from backup

# Immediately after AD recovery:
# Reset krbtgt password TWICE (invalidate Golden Tickets)
Set-ADUser krbtgt -ChangePasswordAtLogon $true
# Wait for replication, then reset again

# Reset all service account passwords
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} |
  Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force)
```

### Step 3 — Server Recovery with Validation

```bash
#!/bin/bash
# recover-server.sh — Validated server recovery procedure
set -euo pipefail

SERVER_NAME="$1"
BACKUP_SOURCE="/backup/verified/$SERVER_NAME"
RESTORE_TARGET="/restore/$SERVER_NAME"
GOLD_IMAGE="/images/server-gold-$(date +%Y%m).qcow2"

echo "[*] Starting recovery for $SERVER_NAME"

# Step 3a: Rebuild OS from gold image
echo "[*] Deploying gold image..."
cp "$GOLD_IMAGE" "/var/lib/libvirt/images/$SERVER_NAME.qcow2"

# Step 3b: Apply current patches
echo "[*] Applying patches..."
virt-customize -a "/var/lib/libvirt/images/$SERVER_NAME.qcow2" \
  --run-command "apt-get update && apt-get upgrade -y"

# Step 3c: Restore data from validated backup
echo "[*] Restoring data from backup..."
mkdir -p "$RESTORE_TARGET"
rsync -av --checksum "$BACKUP_SOURCE/" "$RESTORE_TARGET/"

# Step 3d: Scan restored data
echo "[*] Scanning restored data for malware..."
clamscan -r --infected "$RESTORE_TARGET/" > "/case/recovery/scan-$SERVER_NAME.log" 2>&1

# Step 3e: Verify file integrity
echo "[*] Verifying restored file integrity..."
find "$RESTORE_TARGET" -type f -exec sha256sum {} \; > "/case/recovery/hashes-$SERVER_NAME.txt"

echo "[+] Recovery complete for $SERVER_NAME"
```

### Step 4 — Credential Rotation

```bash
# Full credential rotation — assume ALL credentials compromised

# Domain admin passwords
# Service account passwords
# Local admin passwords (LAPS recommended)
# API keys and tokens
# Database credentials
# Application secrets
# SSL/TLS certificates (if private keys on compromised systems)
# Backup infrastructure credentials
# Cloud IAM credentials

# Ansible playbook for mass credential rotation
ansible-playbook rotate-credentials.yml \
  --extra-vars "scope=all exclude=backup_admin"

# Verify LAPS deployment
Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd |
  Where-Object { $_."ms-Mcs-AdmPwd" -ne $null } |
  Measure-Object
```

### Step 5 — Network Reconnection Criteria

```bash
# Reconnection checklist — ALL must be YES before reconnecting

# [ ] Initial access vector patched/closed
# [ ] All compromised accounts disabled/rotated
# [ ] EDR deployed and active on system
# [ ] System rebuilt or restored from clean backup
# [ ] Malware scan clean
# [ ] Patches current
# [ ] Monitoring enhanced for system
# [ ] Network segmentation applied

# Staged reconnection (not all at once)
# Phase 1: DCs and core infrastructure
# Phase 2: Critical servers (isolated segment)
# Phase 3: Secondary servers
# Phase 4: Workstations (reimaged only)
```

## Detection

```yaml
title: Ransomware Recovery Procedures Detection
id: 53c58fc9-8e06-482e-b8a6-b2735095a87a
status: experimental
description: Detects suspicious activity related to implementing ransomware recovery procedures techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1490
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] All backups validated (hashes, malware scan) before restore
- [ ] Active Directory recovered and krbtgt rotated twice
- [ ] Servers rebuilt from gold images with data restored
- [ ] Full credential rotation completed environment-wide
- [ ] Initial access vector patched before any reconnection
- [ ] EDR deployed on all recovered systems
- [ ] Staged reconnection with monitoring at each phase
- [ ] Recovery time documented against RTO targets

## References

- NIST SP 800-184: Guide for Cybersecurity Event Recovery
- CISA Ransomware Guide: Recovery Section
- Microsoft DART Ransomware Recovery Guide
- CIS Control 11: Data Recovery
