Ransomware, suspected or confirmed
The window between the destruction sequence and encryption is minutes. If you are reading this before encryption has finished, containment is worth more than evidence.
- 01
Isolate at the network, do not power off
by 5 minexpiresPull the network, disable the switch port, or use EDR isolation. Leave the machines running. Powering off destroys memory, and memory is where the encryption key and the operator tooling live.
- 02
Capture memory on one affected host
by 20 minexpiresOne is enough to start. It carries the encryptor, injected code, and sometimes the key. This is the only artifact on the list that cannot be recovered later.
- 03
Check whether backups are actually intact
by 30 minNot whether the backup job reported success: whether a restore works, and whether the backup store was reachable from a compromised credential. Establish this before anyone promises a recovery time.
- 04
Find the destruction sequence in the logs
by 40 minvssadmin, wbadmin and bcdedit, seconds apart. It timestamps the point of no return and usually names the account and host the operator was working from.
- 05
Identify the account used
by 50 minWork backwards from that host. Disable the account, and every account it could have reached. Assume any credential cached on a compromised host is compromised.
- 06
Preserve, then decide about recovery
by 60 minImage at least one host fully before rebuilding anything. Once rebuilt, the evidence is gone, and the questions about scope and data theft arrive days later.