Ransomware Attack Response 🔴 Critical
Comprehensive incident response playbook for detecting, containing, eradicating, and recovering from ransomware attacks. Covers all phases from initial alert through post-incident review. Aligns with NIST SP 800-61 and MITRE ATT&CK framework.
Confirm the alert is a true positive. Check for indicators of compromise (IOCs) including file extensions, ransom notes, and unusual process behavior.
- Alert received from EDR/XDR platform
- IOCs confirmed on affected endpoint
- Ransom note or decryption file found
- File encryption activity verified via logs
Identify all potentially affected systems across the network. Search SIEM and EDR for related IOCs, lateral movement indicators, and unusual admin activities.
Cross-reference IOCs with threat intelligence feeds. Check for known ransomware variants: LockBit, BlackCat, Conti, REvil.
Based on scope assessment, classify the incident and trigger the appropriate response level.
Disconnect infected systems from the network to prevent lateral movement. Do NOT power off — preserve RAM for forensic analysis.
DO NOT power off infected machines. Memory may contain encryption keys or volatile evidence. Use network isolation only.
Update firewall rules, DNS sinkholes, and proxy blocklists with identified IOCs. Block C2 communication channels.
Identify and disable all potentially compromised accounts. Force password resets and revoke active sessions.
- Identify compromised accounts via log analysis
- Disable accounts in Active Directory / Identity Provider
- Revoke all active sessions and tokens
- Revoke service account credentials
- Audit privileged access (admin, root, service accounts)
Create forensic images of affected systems before remediation. Analyze malware samples in a sandboxed environment.
Perform thorough malware removal on all affected systems. Patch the vulnerability that was exploited as the initial access vector.
- Run full anti-malware scan on all systems
- Remove persistence mechanisms (registry, scheduled tasks, services)
- Patch exploited vulnerability (e.g., CVE reference)
- Harden configurations on affected assets
Verify backup integrity before restoration. Ensure backups are clean and taken before the point of compromise.
Verify backup timestamp is BEFORE the initial compromise time identified in step 1.2. Do NOT use backups that may be encrypted.
Document the full incident timeline, root cause analysis, and corrective actions. Update detection rules and this playbook as needed.
- Compile incident timeline with timestamps
- Document root cause and attack chain
- Identify detection gaps and false negatives
- Update SIEM detection rules and EDR policies
- Update this playbook with lessons learned
- Schedule follow-up security awareness training
Determine regulatory reporting obligations and timelines based on the data types affected and jurisdictions involved.
GDPR: 72-hour reporting window. HIPAA: 60-day reporting. CCPA/CPRA: Notification without unreasonable delay. Check industry-specific requirements.