Ransomware Defense Basics Cheat Sheet
Backup strategy, segmentation, detection signals, and incident response steps to prevent and recover from ransomware attacks.
2 PagesBeginnerMar 27, 2026
3-2-1-1 Backup Verification
Script sketch to confirm an offline/immutable backup copy actually exists and restores cleanly.
bash
# 3 copies, 2 media types, 1 offsite, 1 immutable/offline# Verify latest immutable backup snapshot exists (example: AWS Backup vault lock)aws backup list-recovery-points-by-backup-vault \ --backup-vault-name immutable-vault \ --query 'RecoveryPoints[0].{Status:Status,CreationDate:CreationDate}'# Periodically test-restore into an isolated sandbox account/VPC# and checksum the restored data against a known-good hashsha256sum -c restored-data.sha256
Prevention Controls
The controls that stop or slow the initial compromise and lateral spread.
- Immutable backups- object-lock/WORM storage attackers can't encrypt or delete
- Network segmentation- isolate backup infra and critical systems from user VLANs
- MFA everywhere- especially on VPN, RDP, and privileged/admin accounts
- Patch management- prioritize internet-facing and known-exploited CVEs (CISA KEV)
- Least privilege- limit domain admin usage, use tiered admin accounts
- Email/endpoint filtering- block macro-enabled attachments and known malicious domains
Detection & Response Signals
Early indicators and the first response steps if ransomware activity is suspected.
- Mass file renames/encryption- sudden spike in file-extension changes across shares
- Shadow copy deletion- `vssadmin delete shadows` is a near-certain pre-encryption signal
- Unusual outbound traffic- large data transfers before encryption (double-extortion staging)
- Isolate, don't reboot- pull network cable/disable NIC; rebooting can trigger the payload
- Activate IR plan- engage incident response, legal, and law enforcement per playbook
- Restore from clean backup- rebuild from the last known-good immutable snapshot, not in place
Detection Rule: Shadow Copy Deletion
A Sigma rule to catch the near-certain pre-encryption signal of shadow copy deletion.
yaml
title: Suspicious Shadow Copy Deletionstatus: stablelogsource: category: process_creation product: windowsdetection: selection: Image|endswith: - '\vssadmin.exe' - '\wmic.exe' CommandLine|contains: - 'delete shadows' - 'shadowcopy delete' condition: selectionlevel: criticalfalsepositives: - Legitimate disk cleanup by an administrator (rare)
Automated Host Isolation
Script sketch for isolating a compromised host and blocking C2 the moment EDR flags ransomware behavior.
bash
# Auto-isolate a host the moment EDR flags mass-encryption behaviorcurl -s -X POST "https://edr.example.com/api/v1/hosts/$HOST_ID/isolate" \ -H "Authorization: Bearer $EDR_TOKEN" \ -d '{"reason":"ransomware-behavior-detected"}'# Block the C2/staging IP at the perimeter firewalliptables -I FORWARD -s $SUSPECT_IP -j DROP# Disable the compromised account without wiping its audit traildisable-adaccount -Identity $COMPROMISED_USER
Ransomware Kill Chain (MITRE ATT&CK)
How a typical ransomware intrusion progresses from foothold to impact.
- Initial Access- phishing attachment, exposed RDP, or exploited VPN appliance (T1566, T1133)
- Execution- macro or LOLBin (rundll32, regsvr32) launches the loader (T1204, T1218)
- Privilege Escalation- Kerberoasting or token theft to reach domain admin (T1558, T1134)
- Lateral Movement- SMB/RDP enumeration plus PsExec/WMI used to spread (T1021, T1018)
- Defense Evasion- disable AV/EDR, clear event logs before the payload detonates (T1562, T1070)
- Exfiltration- stage and exfiltrate data before encrypting, for double extortion (T1567)
- Impact- shadow copy deletion followed by mass file encryption (T1490, T1486)
Enforcing Backup Immutability
Compliance-mode object lock so retention can't be shortened even by a compromised admin account.
bash
# Enforce compliance-mode object lock - not even the bucket owner/root can# shorten retention or delete a locked object before it expiresaws s3api put-object-lock-configuration \ --bucket immutable-backups \ --object-lock-configuration '{ "ObjectLockEnabled": "Enabled", "Rule": { "DefaultRetention": { "Mode": "COMPLIANCE", "Days": 35 } } }'
Legal, Insurance & Negotiation Considerations
Steps beyond the technical response that determine how badly an incident actually hurts.
- Never negotiate solo- engage a professional ransomware negotiator/IR retainer before any contact with the actor
- OFAC screening- check the threat actor/wallet against sanctions lists; paying a sanctioned group can itself be illegal
- Cyber insurance activation- notify the carrier within the policy's reporting window before remediation actions that could void coverage
- Regulatory notification clocks- GDPR (72h), state breach laws, and sector rules (HIPAA, PCI) often start at discovery
- Preserve evidence- image affected systems before wiping/rebuilding, for forensics and legal requirements
- Chain of custody- document every response action taken for post-incident and potential litigation review
Pro Tip
Test your backup restore process quarterly under a simulated ransomware scenario, not just backup completion — most organizations discover their restore is too slow or the backups were also compromised only after a real attack, when it's too late.
Was this cheat sheet helpful?
Explore Topics
#RansomwareDefenseBasics#RansomwareDefenseBasicsCheatSheet#Cybersecurity#Beginner#3211BackupVerification#PreventionControls#DetectionResponseSignals#Detection#CheatSheet#SkillVeris
