<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Ransomware Response — API Reference

## Variant Identification

### ID Ransomware (Web)
- URL: https://id-ransomware.malwarehunterteam.com
- Upload: ransom note + encrypted file sample
- Returns: variant name, decryptor availability

### No More Ransom
- URL: https://nomoreransom.org/en/decryption-tools.html
- Free decryptors for 160+ ransomware families

### VirusTotal
```bash
curl -s "https://www.virustotal.com/api/v3/files/$SHA256" \
  -H "x-apikey: $VT_KEY" | jq '.data.attributes | {type_description, popular_threat_classification}'
```

## Containment Commands

### EDR Bulk Isolation
```bash
# CrowdStrike — contain multiple hosts
for ID in $(cat devices.txt); do
  curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
    -H "Authorization: Bearer $TOKEN" -d "{\"ids\":[\"$ID\"]}"
done
```

### Network Blocks
```bash
# Block C2 at firewall
iptables -I FORWARD -d $C2_IP -j DROP
iptables -I OUTPUT -d $C2_IP -j DROP

# DNS sinkhole
echo "address=/$C2_DOMAIN/127.0.0.1" >> /etc/dnsmasq.d/sinkhole.conf
```

### Stop Encryption Spread
```powershell
# Disconnect network shares
net use * /delete /yes

# Disable SMB v1
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Block SMB at host firewall
New-NetFirewallRule -DisplayName "Block SMB" -Direction Outbound -LocalPort 445 -Protocol TCP -Action Block
```

## Pre-Ransomware Detection

### Hayabusa — Hunt for Precursors
```bash
# Hunt for shadow copy deletion
hayabusa csv-timeline -d /evtx/ -o precursors.csv --min-level medium
grep -i "shadow\|vssadmin\|bcdedit\|wbadmin" precursors.csv
```

### Key Event IDs
| Event ID | Significance |
|----------|-------------|
| 7045 | Service installation (PsExec, ransomware deployer) |
| 4688 | Process creation (vssadmin, bcdedit, wbadmin) |
| 1102 | Audit log cleared |
| 4624 Type 10 | RDP logon (lateral movement) |

## Recovery Commands

```bash
# Verify backup integrity
sha256sum /backup/latest/* > /evidence/backup-hashes.txt

# Check backup dates vs compromise date
stat /backup/latest/*.bak | grep Modify

# Windows — restore Volume Shadow Copies (if not deleted)
vssadmin list shadows
wmic shadowcopy call create Volume='C:\'

# Restore from Veeam
# Veeam PowerShell: Start-VBRRestoreSession, Restore-VBRFile
```

## Common Patterns

### Response Timeline
```
T+0:00  Alert/Detection
T+0:15  All endpoints isolated via EDR
T+0:30  Variant identified, scope assessed
T+1:00  Evidence preserved (memory, binary, notes)
T+2:00  Law enforcement notified
T+4:00  Backup integrity verified
T+8:00  Recovery from clean backups begins
T+24:00 Systems restored and hardened
T+48:00 Full credential rotation complete
```

### Key Parameters
| Parameter | Description | Example |
|-----------|-------------|---------|
| `variant` | Ransomware family name | `LockBit 3.0` |
| `encryption_scope` | Number of affected files/hosts | `15,000 files / 42 hosts` |
| `backup_status` | Backup availability and integrity | `Clean backup from T-24h` |
| `initial_access` | Entry vector | `Phishing → Cobalt Strike` |
