<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-post-ransomware-security-hardening
description: >-
  Execute comprehensive security hardening after a ransomware incident to
  prevent reinfection. Covers credential reset procedures, Active Directory
  recovery and hardening, endpoint rebuild validation, network architecture
  improvements, detection gap remediation, and security control upgrades
  based on lessons learned from the incident.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - post-incident-hardening
  - credential-reset
  - ad-recovery
  - endpoint-rebuild
  - detection-gaps
  - security-uplift
  - reinfection-prevention
  - lessons-learned
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Performing Post-Ransomware Security Hardening

## Overview

The period after a ransomware incident is the highest-risk window for
reinfection. Attackers commonly maintain persistence mechanisms that
survive initial containment. Approximately 80% of ransomware victims
who pay are hit again, often within 30 days. Comprehensive post-incident
hardening is essential.

Hardening must address the specific entry vector and TTPs used, while
also closing systemic gaps the incident revealed. This is a unique
opportunity — leadership attention and budget are available.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Lynis | System hardening audit | `apt install lynis` |
| CIS-CAT | CIS benchmark assessment | CIS member download |
| Nessus/OpenVAS | Vulnerability scanning | Package install |
| BloodHound | AD attack path analysis | Docker deploy |
| Sysmon | Enhanced telemetry | `sysmon64 -i config.xml` |
| osquery | Endpoint compliance | Package install |

## Key Concepts

### Post-Incident Hardening Priority Matrix

```
Priority 1 (Day 1-3): Eliminate Persistence
  └─ Full credential reset, remove backdoors, patch entry vector

Priority 2 (Day 3-7): Harden Entry Points
  └─ MFA enforcement, VPN patching, email gateway upgrades

Priority 3 (Week 2-3): Improve Detection
  └─ Deploy missing Sigma rules, improve logging coverage

Priority 4 (Week 3-4): Architecture Improvements
  └─ Network segmentation, PAM deployment, backup isolation

Priority 5 (Month 2-3): Resilience Testing
  └─ Purple team validation, tabletop exercises, recovery drills
```

### Hardening Checklist by Attack Phase

| Attack Phase | Hardening Action | Owner |
|-------------|-----------------|-------|
| Initial Access | Patch exploited service, enable MFA | IT Ops |
| Credential Theft | Reset ALL passwords, deploy PAM | Identity |
| Lateral Movement | Segment network, restrict admin shares | Network |
| C2 | Block C2 infra, improve DNS filtering | SOC |
| Exfiltration | Deploy DLP, restrict cloud uploads | Security |
| Encryption | Immutable backups, test recovery | Backup |

## Workflow

### Step 1 — Complete Credential Reset

```bash
# Verify all service accounts have been identified
echo "=== SERVICE ACCOUNT AUDIT ==="
getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $7}' | sort

# Check for accounts with no password expiry
chage -l root 2>/dev/null | grep -i "password expires"

# Force password change on next login for all users
for user in $(getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}'); do
  chage -d 0 "$user" 2>/dev/null
  echo "[*] Password reset forced for: $user"
done

# Check for SSH authorized_keys (potential persistence)
find /home -name "authorized_keys" -exec echo "[!] Found: {}" \; \
  -exec wc -l {} \; 2>/dev/null

# Check for rogue cron jobs (persistence)
for user in $(getent passwd | awk -F: '$3 >= 1000 {print $1}'); do
  crontab -l -u "$user" 2>/dev/null | grep -v "^#" | while read -r line; do
    echo "[!] $user cron: $line"
  done
done
```

### Step 2 — Patch Entry Vector and Harden Services

```bash
# Update all packages (critical after incident)
apt update && apt upgrade -y 2>/dev/null

# Harden SSH configuration
cat > /etc/ssh/sshd_config.d/hardening.conf << 'EOF'
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
X11Forwarding no
AllowTcpForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
EOF

systemctl restart sshd

# Harden kernel parameters
cat > /etc/sysctl.d/99-hardening.conf << 'EOF'
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
EOF

sysctl --system
```

### Step 3 — Improve Detection Coverage

```bash
# Deploy comprehensive auditd rules
cat > /etc/audit/rules.d/ransomware-hardening.rules << 'EOF'
# Monitor credential access
-a always,exit -F arch=b64 -S openat -F path=/etc/shadow -F perm=r -F key=shadow_read
-a always,exit -F arch=b64 -S openat -F path=/etc/passwd -F perm=wa -F key=passwd_change

# Monitor persistence mechanisms
-w /etc/crontab -p wa -k cron_change
-w /etc/cron.d -p wa -k cron_change
-w /var/spool/cron -p wa -k cron_change
-w /etc/systemd/system -p wa -k systemd_change

# Monitor network configuration changes
-w /etc/hosts -p wa -k hosts_change
-w /etc/resolv.conf -p wa -k dns_change

# Monitor SSH access
-w /etc/ssh/sshd_config -p wa -k ssh_config
-w /root/.ssh -p wa -k ssh_keys
EOF

augenrules --load
```

### Step 4 — Run Security Baseline Assessment

```bash
# Lynis hardening audit
lynis audit system --quiet 2>/dev/null | grep -E "Suggestion|Warning" | head -30

# Check for world-writable files (persistence risk)
find / -type f -perm -002 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null | head -20

# Verify no SUID surprises
find / -type f -perm -4000 -not -path "/proc/*" 2>/dev/null | sort > /tmp/suid_current.txt
echo "SUID binaries found: $(wc -l < /tmp/suid_current.txt)"

# Check listening services (minimize attack surface)
ss -tlnp | grep LISTEN | awk '{print $4, $NF}' | sort
```

## Detection

```yaml
title: Post Ransomware Security Hardening Detection
id: 114bec6f-bf32-4b69-b95c-c42f291c5575
status: experimental
description: Detects suspicious activity related to performing post ransomware security hardening techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] All user and service account passwords reset
- [ ] Entry vector patched and hardened
- [ ] SSH hardened (key-only, no root, max attempts limited)
- [ ] auditd rules deployed for persistence and credential monitoring
- [ ] Lynis audit score improved by minimum 20 points from baseline
- [ ] All findings from incident after-action report addressed
- [ ] Purple team validation confirms entry vector is blocked

## References

- CIS Benchmarks: Platform-Specific Hardening Guides
- NIST SP 800-123: Guide to General Server Security
- MITRE ATT&CK T1078: Valid Accounts (Persistence)
- CISA Post-Incident Activity Guide
- SANS SEC505: Securing Windows and PowerShell
