<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: ransomware-defense
description: >-
  Ransomware defense operations including prevention controls, detection of
  ransomware precursors (RDP brute force, Cobalt Strike beacons, lateral movement),
  backup integrity verification, ransomware negotiation considerations, recovery
  procedures, decryptor identification, and post-incident hardening. Covers
  ransomware-as-a-service (RaaS) ecosystem and major families (LockBit, BlackCat/ALPHV,
  Cl0p, Royal, Black Basta, Akira, Play).
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - ransomware
  - backup-recovery
  - raas
  - lockbit
  - blackcat
  - cobalt-strike
  - data-exfiltration
  - business-continuity
  - incident-response
  - double-extortion
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1486", "T1490", "T1489", "T1021.001", "T1048", "T1071"]
  nist-csf: ["PR.IP-4", "PR.IP-9", "DE.CM-1", "RS.RP-1", "RC.RP-1"]
  frameworks: ["CISA Ransomware Guide", "NIST IR 8374", "No More Ransom Project"]
---

# Ransomware Defense

## When to Use

Activate when the operator asks about ransomware prevention, backup strategy,
ransomware detection, recovery procedures, ransomware negotiation, RaaS groups,
or post-ransomware hardening.

Mode: `[MODE: BLUE]` for prevention/detection; `[MODE: INCIDENT]` for active ransomware response; `[MODE: ARCHITECT]` for resilient architecture.

## Quick Reference

| Phase | Action | Priority |
|-------|--------|----------|
| Prevention | Immutable offline backups (3-2-1 rule) | 🔴 Critical |
| Prevention | Disable RDP or require VPN+MFA | 🔴 Critical |
| Prevention | Patch internet-facing systems within 48h | 🔴 Critical |
| Prevention | Email gateway with attachment sandboxing | 🟡 High |
| Prevention | Application allowlisting on servers | 🟡 High |
| Detection | Monitor for Cobalt Strike beacons (malleable C2) | 🔴 Critical |
| Detection | Alert on mass file rename/encryption patterns | 🔴 Critical |
| Detection | Detect VSS deletion (`vssadmin delete shadows`) | 🔴 Critical |
| Detection | Monitor for data staging/exfil before encryption | 🟡 High |
| Response | Isolate affected systems (network, not power off) | 🔴 Immediate |
| Response | Preserve evidence before recovery | 🔴 Critical |
| Recovery | Identify ransomware family → check for decryptor | 🟡 High |
| Recovery | Restore from verified clean backups | 🔴 Critical |

## Workflow

### 1. Ransomware Kill Chain Detection

```
Typical ransomware attack timeline (days to weeks):

Day 0:   Initial access (phishing, RDP brute force, VPN exploit)
Day 1-3: Cobalt Strike/Sliver beacon established, recon
Day 3-7: Credential harvesting (Mimikatz, LSASS), lateral movement
Day 7-14: Domain admin achieved, data discovery and staging
Day 14-21: Data exfiltration (double extortion preparation)
Day 21+:  Ransomware deployment (off-hours, weekends, holidays)

Detection windows (earliest to latest):
├── Initial access: Failed RDP logins, phishing email blocked, VPN anomaly
├── C2 establishment: Beacon traffic, DNS anomalies, JA3/JA4 fingerprints
├── Credential theft: LSASS access (Sysmon EID 10), DCSync (EID 4662)
├── Lateral movement: PsExec/WMI/WinRM (EID 4648), service installs (EID 7045)
├── Data staging: Large archive creation, unusual SMB transfers
├── Exfiltration: Mega.nz/rclone uploads, unusual outbound data volume
└── Encryption: Mass file renames, VSS deletion, ransom note creation
```

### 2. Detection Rules

```yaml
# Sigma: VSS Shadow Copy Deletion
title: Volume Shadow Copy Deletion - Ransomware Indicator
id: c947b146-0abc-4f87-9c64-b17e9d7b9a4e
status: stable
description: Detects deletion of volume shadow copies, common ransomware precursor
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    CommandLine|contains|all:
      - 'vssadmin'
      - 'delete'
      - 'shadows'
  selection_wmic:
    CommandLine|contains|all:
      - 'wmic'
      - 'shadowcopy'
      - 'delete'
  selection_ps:
    CommandLine|contains: 'Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() }'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin cleanup (rare, should be change-controlled)
level: critical
tags:
  - attack.impact
  - attack.t1490

---
# Sigma: Mass File Rename (Ransomware Encryption)
title: Mass File Extension Change - Ransomware Encryption
id: d8f3e021-7c89-4a3d-b2e5-9f8a1c3d5e7f
status: experimental
description: Detects mass file rename operations indicating ransomware encryption
logsource:
  category: file_rename
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.locked'
      - '.encrypted'
      - '.crypt'
      - '.enc'
  timeframe: 1m
  condition: selection | count() > 50
level: critical
tags:
  - attack.impact
  - attack.t1486
```

### 3. Backup Strategy (3-2-1-1-0)

```
3-2-1-1-0 Rule:
├── 3 copies of data (production + 2 backups)
├── 2 different media types (disk + tape/cloud)
├── 1 offsite copy (geographically separated)
├── 1 offline/immutable copy (air-gapped or WORM)
└── 0 errors (verified restore testing)

Implementation:
├── Daily incremental backups to NAS (Veeam/Commvault)
├── Weekly full backup to immutable S3 (Object Lock/WORM)
├── Monthly backup to offline tape or disconnected disk
├── Quarterly restore testing (full environment recovery drill)
└── Backup admin accounts separate from domain (not domain-joined)

Critical: Backup infrastructure must be isolated
├── Separate credentials (not domain accounts)
├── Network segmentation (backup VLAN)
├── MFA on backup console access
├── Immutability enabled (cannot delete within retention)
└── Monitor backup job success/failure
```

### 4. Incident Response — Active Ransomware

```
IMMEDIATE (0-30 min):
1. Isolate: Disable network (don't power off — preserve memory)
2. Scope: Which systems encrypted? What data affected?
3. Identify: Ransom note → ransomware family → check nomoreransom.org
4. Preserve: Memory dump before any remediation
5. Notify: CISO, legal, law enforcement (FBI IC3/CISA)

CONTAINMENT (30 min - 4 hours):
1. Block C2 IPs/domains at firewall
2. Reset all privileged credentials (DA, service accounts)
3. Disable compromised accounts
4. Deploy EDR containment on all endpoints
5. Check for data exfiltration indicators

RECOVERY (4 hours - days):
1. Verify backup integrity (scan for malware before restore)
2. Rebuild from known-good images (don't restore infected systems)
3. Restore data from immutable backups
4. Validate restored systems before reconnecting
5. Monitor for re-infection indicators

DO NOT:
- Pay ransom without legal/insurance consultation
- Negotiate without professional negotiator
- Restore without confirming backups are clean
- Reconnect systems without hardening entry vector
```

### 5. Ransomware Family Identification

```bash
# ID Ransomware
# Upload ransom note or encrypted sample to id-ransomware.malwarehunterteam.com

# Check for free decryptors
# https://www.nomoreransom.org/en/decryption-tools.html

# Common indicators:
# LockBit 3.0: .HLJkNskOq extension, "Restore-My-Files.txt"
# BlackCat/ALPHV: random extension, "RECOVER-[random]-FILES.txt"
# Cl0p: .Cl0p extension, "ClopReadMe.txt"
# Royal: .royal extension, "README.TXT"
# Black Basta: .basta extension, "readme.txt"
# Akira: .akira extension, "akira_readme.txt"
# Play: .play extension, "ReadMe.txt"
```

## Verification

- [ ] 3-2-1-1-0 backup strategy implemented and tested
- [ ] Immutable/offline backup verified (cannot be deleted by admin)
- [ ] RDP disabled or behind VPN+MFA
- [ ] Ransomware precursor detection rules deployed
- [ ] Backup restore drill completed within RTO
- [ ] IR playbook for ransomware tested via tabletop exercise
- [ ] Email gateway with sandbox detonation active
