Ransomware readiness and response
You learn the stages of a ransomware attack, make backups attack-resistant, watch for early warning signs and lead the response in a safe simulation.
Level 401 · 12 lessons · 12 practice labs
Lessons
Preparation
- The stages of a ransomware attack
- Immutable and offline backups
- Restore testing: having a backup is not enough
- Short task: protect the backup server against deletion and test a restore
Early warning
- Precursor signs: discovery, backup deletion, shadow copies
- Catching encryption early with canary files
- Detecting mass file changes
- Short task: build a set-up that alerts within 60 seconds of encryption starting
Response
- The first hour: stopping the spread
- Scope and recovery order
- Extortion, communication and legal advice
- Capstone: contain a simulated ransomware attack and bring the business back from backup
Practice labs
- Work out where the backups live and who can delete them: List the repositories on the backup server, the latest backup dates and the accounts able to delete.
- Protect the backup repository against deletion: Put the repository in append-only mode or protect it with the immutable flag, and show a delete request from the production server is refused.
- Run a measured restore test and compare it with the target time: Restore the file server from backup onto a separate machine, verify integrity with hashes, time it and identify the step that misses the recovery objective.
- Match the stages of a ransomware attack to log records: Place ten given records under initial access, discovery, spread, backup deletion and encryption.
- Write a rule that catches shadow copy and backup deletion commands: Write a detection rule for command lines that delete shadow copies and turn off recovery options, and test it on recorded data.
- Combine precursor signs into one high-confidence alert: Build a rule correlating network discovery, a privileged logon and backup deletion on one host within an hour, excluding the backup admin’s routine work.
- Plant a canary file on a share and watch access to it: Put a file nobody should open on the share, add an audit rule and show a record appears when the file changes.
- Detect mass file changes with a threshold: Write a rule that catches a process renaming more than a hundred files in a minute and keep the archiving job from raising a false alarm.
- Build a set-up that alerts within 60 seconds of encryption starting: Combine canary, mass-change and extension-change signals, run the safe simulator and measure the time from first file to alert.
- Put the first hour’s steps in the right order: Order ten response steps with stopping the spread first and mark which one would destroy evidence.
- Set the scope of affected systems and the recovery order: Extract the encrypted shares and hosts from the logs and write the recovery order by business criticality and dependencies.
- Contain a simulated attack and bring the business back from backup: Stop the safe simulator spreading, close the way in, restore the file server from clean backup and write management a note on communication and legal advice.
About this course
You learn the stages of a ransomware attack, make backups attack-resistant, watch for early warning signs and lead the response in a safe simulation.
What you will learn
- Preparation
- Early warning
- Response
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.