Anthropic-Cybersecurity-Skills/skills/performing-ransomware-incident-response/references/workflows.md

Ransomware Incident Response - Detailed Workflow

Phase 1: Detection and Initial Assessment (0-30 minutes)

Detection Sources

1. EDR/AV alert for ransomware behavior (mass file encryption)
2. User reports of inaccessible files or ransom notes
3. SIEM correlation of suspicious patterns (VSS deletion + mass file writes)
4. Backup system alerts for failed or corrupted backups
5. Canary file monitoring triggers

Initial Assessment Steps

1. Confirm ransomware activity (not a false positive or legitimate encryption)
2. Identify patient zero (first infected system)
3. Determine ransomware variant from ransom note or encrypted file extension
4. Check if encryption is still in progress or completed
5. Assess scope: single host, department, or enterprise-wide
6. Activate incident response team and establish war room

Variant Identification

1. Upload ransom note to ID Ransomware (id-ransomware.malwarehunterteam.com)
2. Submit encrypted file sample to identify encryption algorithm
3. Check file extension against known ransomware database
4. Cross-reference IOCs with threat intelligence feeds
5. Search for Bitcoin wallet addresses in threat intel databases

Phase 2: Containment (30-120 minutes)

Immediate Actions

1. Network-isolate all confirmed infected hosts via EDR
2. Block known C2 IPs/domains at perimeter firewall
3. Disable file sharing (SMB, NFS) between network segments
4. Block lateral movement protocols (RDP, WinRM, PsExec)
5. Disable compromised user/service accounts
6. Take backup systems offline (protect from encryption)

Network Segmentation

1. Implement emergency firewall rules between VLANs
2. Disable inter-VLAN routing for affected segments
3. Block east-west traffic for non-essential ports
4. Enable full packet capture on affected segments
5. Deploy network honey tokens

Backup Protection Priority

1. Disconnect backup networks from production
2. Verify immutable backup copies exist and are intact
3. Test a sample restoration to confirm backup viability
4. Document last known good backup date for each system
5. If using cloud backups, verify object lock/WORM settings

Phase 3: Investigation (2-48 hours)

Determine Initial Access Vector

1. Review VPN/remote access logs for compromised credentials
2. Check email logs for phishing delivery
3. Analyze exploitation of public-facing applications
4. Review RDP brute force attempts in event logs
5. Check supply chain/third-party access logs

Map Attack Timeline

1. Correlate SIEM/EDR data to build attack chronology
2. Identify dwell time (initial access to encryption)
3. Map lateral movement path through the network
4. Identify all systems accessed by the attacker
5. Determine if data was exfiltrated before encryption

Evidence Collection

1. Capture memory images from key systems
2. Create forensic disk images before remediation
3. Export relevant SIEM logs (authentication, file access, network)
4. Preserve EDR detection data and timeline
5. Document all ransom communications

Phase 4: Eradication (24-72 hours)

Remove Attacker Persistence

1. Identify and remove all backdoors (web shells, RATs, implants)
2. Remove scheduled tasks created by the attacker
3. Clean malicious registry entries
4. Remove unauthorized user accounts
5. Revoke all compromised credentials (including KRBTGT if needed)
6. Patch the vulnerability used for initial access

Validate Clean State

1. Run full AV/EDR scans on all systems
2. Scan with YARA rules specific to the ransomware family
3. Verify no unauthorized processes or services
4. Check for fileless persistence mechanisms
5. Validate Group Policy objects are clean

Phase 5: Recovery (24 hours - 2 weeks)

Recovery Prioritization

Priority	System Category	Recovery Target
P1	Domain controllers, DNS, DHCP	4-8 hours
P2	Email, communication systems	8-24 hours
P3	Core business applications	24-72 hours
P4	File shares, secondary systems	3-7 days
P5	Non-critical workstations	1-2 weeks

Recovery Steps

1. Rebuild systems from known-good images (not infected backups)
2. Restore data from verified clean backups
3. Apply all security patches before reconnecting to network
4. Reset all passwords enterprise-wide
5. Implement MFA on all remote access
6. Reconnect systems in phases with enhanced monitoring
7. Verify data integrity after restoration

Decryption Assessment

1. Check nomoreransom.org for available decryptors
2. Contact law enforcement for potential seized decryption keys
3. Assess if partial decryption is possible
4. Evaluate third-party decryption services (with caution)
5. Document any data that cannot be recovered

Phase 6: Post-Incident (1-4 weeks)

Lessons Learned

1. Conduct formal after-action review
2. Document complete attack timeline
3. Identify what worked and what failed in the response
4. Update incident response playbook based on findings
5. Brief executive leadership and board

Preventive Improvements

1. Implement or enhance immutable backups
2. Deploy additional network segmentation
3. Improve endpoint detection rules
4. Conduct security awareness training
5. Test backup restoration procedures regularly
6. Implement privileged access management (PAM)