Responding to a ransomware incident
As soon as encryption starts you stop the spread, establish the initial access and whether data was taken, restore safely from backups and present decision options to management.
Level 401 · 13 lessons · 12 practice labs
Lessons
The first hours
- Stages of a ransomware attack: entry, spread, exfiltration, encryption
- Stopping the spread: network isolation, account lockout, closing shares
- Preserving evidence before you restore
- Identifying the family from the note and encrypted files
- Short task: keep the decision log for the first 30 minutes
Investigation
- Finding initial access: VPN, RDP, phishing, an exposed service
- Tracing lateral movement and abuse of admin tools
- Was data taken: archiving, upload tools and network traces
- Short task: build a timeline from patient zero to encryption
Recovery and decisions
- Validating backups: clean, complete, working
- Staged recovery and preventing reinfection
- Briefing management: ransom, legal, insurance and notification options
- Capstone: run a ransomware incident from containment to recovery
Practice labs
- Determine the stage of the attack: From four symptoms decide whether the incident is at entry, spread, exfiltration or encryption stage.
- Apply the steps that stop the spread: Close the shares, lock the account and isolate the segment on the lab network, verifying each step.
- The decision log of the first 30 minutes: Record your decisions with time, information and reasoning as incident reports flow in.
- Identify the family from the ransom note: Identify the family by matching the note text and file extension to the in-lab reference list.
- Preserve evidence before restoring: Collect and hash memory, logs and a disk image from the affected server before restoration begins.
- Derive time and scope from the encrypted files: From the encrypted files' timestamps derive the start of encryption, its speed and the affected shares.
- Find the initial entry path: Determine from VPN, remote desktop and email logs which path the first entry took.
- Was data taken out: Prove or refute data exfiltration from archiving traces, upload tool remnants and network logs.
- A timeline from patient zero to encryption: From Demirsu Enerji's prepared evidence produce a timeline from first entry to encryption including lateral movement.
- Verify the backup is clean: Open the backup in an isolated environment and check its integrity and that it is free of persistence traces.
- A staged recovery order: Put the systems in recovery order by dependency and business priority and add reinfection checks.
- Prepare the management briefing: Present the ransom, legal, insurance and notification options with their risks on one page.
About this course
As soon as encryption starts you stop the spread, establish the initial access and whether data was taken, restore safely from backups and present decision options to management.
What you will learn
- The first hours
- Investigation
- Recovery and decisions
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.