Ransomware Across Two VLANs With One Immutable Backup
At 02:14 on a Tuesday, the SOC receives 43 EDR alerts for shadow-copy deletion across 11 servers in two VLANs. File shares on three servers now contain files with a new extension and ransom notes. The backup administration console is unreachable, and one immutable cloud repository last synced six hours ago. The domain controller shows no EDR alert, but a service account used on the three file servers authenticated to it at 01:58 from an unusual workstation. The company runs 24/7 order fulfillment with 900 employees; the plant-floor OT network is segmented but shares a jump host with IT. Two affected servers are in PCI scope, so the breach-notification clock starts once compromise is confirmed. The CISO asks for containment options and is worried about stopping fulfillment.
1. Rank the first three containment actions and justify the order. Address why immediately powering off every server is a poor default.
Read the worked answer
1. Protect the immutable backup and revoke the backup service account. The six-hour-old immutable copy is the recovery anchor; if the attacker reaches the backup console, recovery options collapse. Revoke the account and confirm the cloud repository is truly immutable before any restore discussion.
2. Contain affected VLANs at the switch or EDR, not by shutdown. Network containment stops lateral SMB spread while keeping memory and volatile evidence intact. Apply EDR network containment to the three file servers first, then the other eight alerting hosts, and monitor the domain controller.
3. Capture memory from one representative file server before remediation. Powering off destroys encryption keys, injected code, and network connections that show command-and-control and lateral movement.
Powering off every server is a poor default because it destroys volatile evidence, may interrupt replication that reveals scope, and does not guarantee the encryption is stopped if scheduled tasks persist. It also slows recovery and can strand fulfillment. Containment should be reversible and evidence-preserving; shutdown is a last resort when a host is actively causing harm that isolation cannot stop.
2. The domain controller has no EDR alert. What evidence would you require before deciding to rebuild it versus restore from backup? Give decision criteria.
Read the worked answer
Absence of an EDR alert is not evidence of integrity. Pull Windows security logs for the service account: look for logon type 3 or 10 from the unusual workstation, 4769 Kerberos service-ticket requests using RC4, 4662 directory-replication access, and 4624 events outside normal patterns. Check SMB sessions and share access on the DC, scheduled tasks, new services, and PowerShell operational logs. Review EDR memory for the service account process context and any unsigned modules.
Decision criteria: rebuild if a domain-admin-equivalent credential was used from a compromised host, if code executed in DC memory, or if directory replication or DCSync behavior appears. Restore only if the DC shows no code execution and only a low-privilege service account authenticated, and even then reset that credential and monitor closely. If there is any doubt about domain-admin exposure, rebuild because restoring a potentially backdoored DC returns the attacker to the trust root.
3. What chain-of-custody and notification steps apply in the first 24 hours?
Read the worked answer
Preserve evidence in a documented sequence: photograph and label the affected servers, hash disk images and memory captures, record collector, time, tool, and storage location, and use dual control for PCI-scoped systems. Keep original logs in place and export copies with hashes; do not let remediation overwrite them. Place a legal hold on email and endpoint telemetry.
Notification is staged, not immediate to everyone. Notify legal counsel, the privacy officer, and the cyber insurer first; confirm whether cardholder data was actually accessed or only encrypted. PCI notification goes through the acquirer and card brands after confirmation, not on suspicion alone. Engage an external forensics firm if the team lacks ransomware experience. Do not notify customers until scope and legal advice are clear, but start the documented 24-hour clock so the eventual regulatory assessment is defensible.