Ransomware Containment with Backups at Risk
At 02:14 on Tuesday, Cisco Secure Endpoint raises 'Suspicious Ransomware Behavior' on 37 Windows hosts and the file server FS01 begins renaming documents to .locked. Telemetry shows service creation consistent with PsExec from WKS-042, SMB sessions to 10.20.4.0/24, and a 300-second TLS beacon from WKS-042 to 185.199.108.77. FS01 and backup server BK01 sit on the same VLAN; BK01 is not yet encrypted. The IR team has four analysts, a six-hour window before business opens, and a legal hold notice for a pending lawsuit. EDR isolation is available, but the network team can also shut switch ports. Full packet capture is not enabled. Executives ask whether to restore from backup immediately or rebuild. The backup catalog shows last night's full backup completed at 23:40, but no restore test has been performed in 14 months.
1. Sequence the first 30 minutes of containment. Justify why some actions wait.
Read the worked answer
Protect BK01 first: apply a temporary ACL or shut the switch port for BK01's VLAN so SMB cannot reach it; backups are the recovery lifeline and the highest-impact target. Next isolate WKS-042 via EDR network containment, not power-off, to stop lateral SMB while preserving memory and remote triage. Then isolate the 37 alerted hosts in waves, starting with those showing SMB sessions to FS01; use switch-port shutdown only for hosts without EDR. Block the C2 IP/domain at Secure Firewall and Umbrella. Delay a domain-wide password reset until you know which service accounts were used, because a reset can destroy evidence of active sessions and cause outages. Do not restore yet; restoration before scoping risks re-infection. Record timestamps and ticket IDs for legal hold.
2. What evidence do you collect and in what order, given volatile data and legal hold?
Read the worked answer
Collect in order of volatility: memory from WKS-042 and FS01 if EDR supports it, before isolation or reboot; running processes, network connections, scheduled tasks, and service creation; EDR telemetry exports; firewall and Umbrella logs for the beacon; SMB session and file-share audit logs; backup catalog and BK01 logs. Image FS01's system volume before any restore, and preserve the ransomware note and encrypted file samples. Because legal hold applies, hash and log each artifact, maintain chain of custody, and avoid wiping hosts until forensic images are made. If business pressure forces restoration, restore to an isolated VLAN first and scan; document the deviation. Shutting down hosts may lose memory and encryption keys, so keep them powered and network-isolated.
3. How do you decide between restore and rebuild, and what do you communicate?
Read the worked answer
Rebuild rather than restore if domain-admin or backup credentials were stolen, if persistence is found on FS01, or if backup integrity is unverified. Restore only after testing a backup in an isolated VLAN, validating file integrity, and scanning with current signatures. Rebuild WKS-042 and any host with PsExec service creation. Decision criteria: scope of credential theft, presence of persistence, backup cleanliness, and recovery time objective. Communicate to executives in business terms: containment status, data at risk, recovery timeline, and legal constraints. Do not engage the attacker or pay ransom without law enforcement and legal approval. Preserve evidence for the lawsuit; a restore is not a substitute for forensic imaging.