Ransomware Precursor on a Segment With No Egress
At 02:14 a SIEM rule fires 47 times in six minutes: WinEvent 4688 on host FIN-WS-22 shows cmd.exe /c vssadmin delete shadows /all /quiet, each spawned by powershell.exe -enc <base64>. The parent process is outlook.exe. FIN-WS-22 sits in the Finance VLAN, which has no route to the internet; its only egress is through a proxy that logs and blocks uncategorized destinations. EDR shows no outbound connection from the host after the encoded PowerShell ran, and the base64 decodes to a shadow-copy deletion routine with no download stager. The on-call analyst notes the user reported a "invoice" attachment at 01:58 and that FIN-WS-22 holds a mapped drive to the file server. Backup jobs to the file server run at 03:00.
1. The SOC lead asks whether to declare a ransomware incident now. What is the defensible call, and what evidence drives it?
Read the worked answer
Declare it. Shadow-copy deletion via encoded PowerShell spawned from a mail client is a high-fidelity ransomware precursor, not ambiguous noise. The absence of an egress connection does not downgrade severity: the payload may be staged locally, the segment may be blocked by design, or the stager may use the proxy or the mapped drive as a channel. The decisive facts are (1) the parent-child chain outlook.exe -> powershell -enc -> vssadmin, (2) the 03:00 backup window creating a deadline, and (3) the mapped drive giving lateral reach to the file server. Waiting for encryption to confirm is the wrong trade: the cost of a false positive (an hour of containment) is far below the cost of a missed encryption event over the backup.
2. List the first four containment actions in priority order and justify the ordering against the 03:00 backup.
Read the worked answer
- Isolate FIN-WS-22 at the network layer (EDR network containment or switch port shutdown) - stops further execution and any lateral movement without destroying volatile memory.
- Disable or suspend the mapped drive / revoke the user's file-server session - removes the path from the compromised host to the data the attacker most wants. Do this before or simultaneously with host isolation because the drive is the blast radius.
- Suspend or gate the 03:00 backup job and snapshot current backup state - an encrypted or tampered backup overwrites good recovery points. Preserve the last known-good set rather than let the schedule run blind.
- Preserve volatile evidence before any reboot or reimage - memory capture and the
-encpayload string, then the disk image. Reimaging first is the classic mistake; the encoded command and parent process are the only thread back to the delivery vector.
Ordering rationale: cut the lateral path first, protect recovery data second, capture evidence third - all before the clock reaches 03:00.
3. The user insists the attachment was opened on a different machine. How should the analyst treat that claim?
Read the worked answer
Treat it as a lead, not a fact. Corroborate with data the user cannot influence: mail gateway logs for delivery time and recipient, proxy logs for the user's other hosts, and EDR process trees across all endpoints assigned to that user. The 01:58 report and the 02:14 execution are consistent with the named host, so the claim may be a misremembering or a deflection. If a second host exists, it needs the same isolation and evidence preservation. Do not close the FIN-WS-22 investigation on the user's statement; user testimony is supporting context, not evidence of absence.