Labels

Incident Response for Ransomware Attack

 

Description

This Standard Operating Procedure (SOP) establishes a comprehensive framework for detecting, responding to, and recovering from ransomware attacks within the enterprise environment. It should be activated immediately upon detection or suspicion of ransomware activity to minimize data loss, contain the threat, and restore normal business operations. This procedure is intended for SOC analysts (L1, L2, L3), Incident Response teams, IT operations, endpoint security teams, and network administrators.

Purpose

The purpose of this SOP is to provide a standardized, repeatable methodology for responding to ransomware incidents across the enterprise. This procedure aims to:

  • Rapidly detect and validate ransomware activity
  • Contain the threat to prevent lateral movement and additional encryption
  • Eradicate malicious artifacts and attacker access
  • Restore affected systems and data from clean backups
  • Document lessons learned and improve defensive posture
  • Minimize business disruption, data loss, and financial impact

This SOP ensures consistent incident handling aligned with industry best practices, regulatory requirements, and organizational security policies.

Scope

This SOP applies to:

Systems:

  • All Windows, Linux, and macOS endpoints (workstations, laptops)
  • Physical and virtual servers (on-premises and cloud-hosted)
  • Network-attached storage (NAS) and file servers
  • Database servers and application servers
  • Cloud infrastructure (IaaS, PaaS, SaaS)
  • Backup and disaster recovery systems
  • Industrial control systems (ICS) and operational technology (OT) where applicable

Users:

  • Employees (full-time, part-time, contractors)
  • Third-party vendors with network access
  • Privileged users and system administrators
  • Remote and hybrid workforce

Environments:

  • Production environments
  • Development and testing environments
  • Corporate network infrastructure
  • Remote access infrastructure (VPN, RDP, Citrix)
  • Multi-tenant and shared service environments

Roles & Responsibilities

SOC Level 1 (L1) Analyst

  • Monitor security alerts from SIEM, EDR, and other detection platforms
  • Perform initial triage of ransomware alerts and user reports
  • Document all findings in the incident ticketing system
  • Execute immediate containment actions (network isolation)
  • Notify SOC L2/L3 and stakeholders per escalation matrix
  • Follow predefined playbooks and standard response procedures
  • Maintain chain of custody for digital evidence

SOC Level 2 (L2) Analyst

  • Conduct detailed analysis of ransomware indicators and behavior
  • Identify patient zero and construct attack timeline
  • Determine scope of compromise across the environment
  • Perform threat hunting for additional compromised systems
  • Coordinate containment activities with IT and network teams
  • Collect and preserve forensic evidence
  • Provide technical guidance to L1 analysts
  • Escalate complex incidents to L3 or Incident Response team

SOC Level 3 (L3) Analyst

  • Lead technical investigation and forensic analysis
  • Perform advanced malware analysis and reverse engineering
  • Develop custom detection rules and hunting queries
  • Coordinate cross-functional response activities
  • Advise on eradication and recovery strategies
  • Engage with external resources (forensic firms, threat intelligence)
  • Conduct root cause analysis
  • Lead post-incident review sessions

Incident Response Team

  • Serve as Incident Commander for critical ransomware events
  • Make strategic decisions regarding containment and recovery
  • Coordinate with executive leadership and legal counsel
  • Manage communications with external parties (law enforcement, regulators, cyber insurance)
  • Authorize business continuity and disaster recovery activation
  • Evaluate ransom payment considerations (in coordination with legal and executive teams)
  • Oversee post-incident remediation activities
  • Ensure compliance with breach notification requirements

IT / Endpoint / Network Teams

  • Execute containment actions (network isolation, account disablement)
  • Implement emergency firewall rules and access control lists
  • Disable compromised accounts and reset credentials
  • Restore systems from verified clean backups
  • Apply security patches and configuration hardening
  • Validate system integrity post-recovery
  • Reconfigure network segmentation as directed
  • Support forensic data collection activities

Management / Executive Leadership

  • Provide resources and budget for incident response
  • Approve critical business decisions (system shutdowns, ransom considerations)
  • Authorize engagement of external vendors and legal counsel
  • Manage stakeholder communications (board, customers, partners, media)
  • Ensure business continuity plan activation
  • Review incident response effectiveness and approve remediation plans

Prerequisites

Required Tools

  • Endpoint Detection and Response (EDR) platform with network isolation capability
  • Security Information and Event Management (SIEM) system
  • Network traffic analysis tools (NetFlow, IDS/IPS, packet capture)
  • Forensic imaging tools (FTK Imager, dd, EnCase, X-Ways)
  • Malware analysis sandbox (Cuckoo, Any.Run, Joe Sandbox)
  • Threat intelligence platform (MISP, ThreatConnect, Recorded Future)
  • Vulnerability scanning tools
  • Backup and disaster recovery systems
  • Secure evidence storage repository
  • Incident management platform (ServiceNow, Jira, etc.)

Required Access

  • Administrative credentials for EDR/SIEM consoles
  • Network device management access (firewalls, switches, routers)
  • Active Directory/LDAP administrative privileges
  • Cloud platform administrative consoles (AWS, Azure, GCP)
  • Backup system administrative access
  • Privileged Access Management (PAM) system access
  • Forensic workstation with isolated network access

Required Logs (Minimum 90-day retention recommended)

  • Endpoint security logs (EDR, antivirus, host-based firewall)
  • Windows Event Logs (Security, System, Application, PowerShell)
  • Linux/Unix system logs (syslog, auth.log, audit.log)
  • Network device logs (firewall, proxy, DNS, DHCP, VPN)
  • Email gateway and spam filter logs
  • Authentication logs (Active Directory, SSO, MFA)
  • Web application firewall (WAF) logs
  • Database audit logs
  • Cloud service audit logs (CloudTrail, Azure Activity Log)

Required Approvals

  • Change Advisory Board (CAB) emergency approval for production system isolation
  • Incident Commander authorization for network-wide containment
  • Legal counsel approval before law enforcement engagement
  • Executive leadership approval for ransom payment consideration
  • Privacy officer notification for potential data breach

Incident Identification

Ransomware incidents may be identified through multiple detection methods:

Automated Security Alerts

  • EDR alerts indicating:
    • Mass file encryption activity
    • Suspicious process behavior (vssadmin.exe deleting shadow copies)
    • Execution of known ransomware binaries
    • Unauthorized use of encryption tools
    • Abnormal file system modifications
  • SIEM correlation rules detecting:
    • Multiple failed login attempts followed by successful authentication
    • Lateral movement patterns using SMB, RDP, or WMI
    • Scheduled task creation for persistence
    • PowerShell encoded command execution
    • Connections to known ransomware command-and-control (C2) infrastructure
  • Network-based detections:
    • Traffic to malicious IP addresses or domains
    • Anomalous data exfiltration volumes
    • TOR network connections from internal systems
    • SMB scanning activity across network segments

User Reports

  • Desktop ransom notes or lock screens demanding payment
  • Inability to access files (encrypted with unusual extensions)
  • Files renamed with extensions like .locked, .encrypted, .crypt, .enc
  • Desktop wallpaper changed to ransom message
  • Severe system performance degradation
  • Unexpected system reboots or crashes
  • Pop-up messages demanding cryptocurrency payment

Threat Hunting Indicators

  • Presence of ransom note files (README.txt, HOW_TO_DECRYPT.html, DECRYPT_INSTRUCTIONS.txt)
  • Suspicious processes running from temporary directories
  • PowerShell execution with Base64-encoded commands
  • Unusual outbound network connections
  • Unauthorized remote access tools (Cobalt Strike, Metasploit, commercial RMM tools)
  • Privilege escalation attempts
  • Shadow copy deletion commands (vssadmin delete shadows /all /quiet)
  • Disabled security tools or services
  • Modified file extensions en masse

Third-Party Intelligence

  • Threat intelligence feeds reporting indicators matching internal assets
  • Dark web monitoring alerts (stolen credentials, leaked data)
  • Cyber insurance provider notifications
  • Law enforcement or FBI warnings
  • Information Sharing and Analysis Center (ISAC) alerts
  • Vendor security bulletins

Incident Triage & Validation

Initial Assessment (Target: 15 minutes)

  1. Review Initial Alert or Report

    • Examine the triggering alert details in SIEM/EDR
    • Review user-reported symptoms and affected systems
    • Note the timestamp of first detection
    • Identify affected user accounts and systems

  2. Verify Ransomware Indicators

    • Check for ransom note files on affected systems
    • Identify encrypted files and modified file extensions
    • Review process execution history for encryption behavior
    • Examine network connections for C2 communication
    • Query EDR for suspicious parent-child process relationships

  3. Check EDR/SIEM for Related Activity

    • Search for additional affected endpoints
    • Review authentication logs for compromised accounts
    • Identify potential patient zero (first infected system)
    • Check for data exfiltration attempts prior to encryption
    • Look for reconnaissance or enumeration activities

  4. Confirm Not a False Positive

    • Verify this is not legitimate encryption software (BitLocker, VeraCrypt)
    • Rule out authorized backup or synchronization processes
    • Confirm not user-initiated file compression (ZIP, RAR)
    • Validate against known false positive patterns
    • Cross-reference with change management records

Severity Assessment

Assign incident severity based on the following criteria:

CRITICAL (P1)

  • Production systems encrypted or unavailable
  • Core business operations halted
  • Confirmed data exfiltration (double extortion)
  • Active lateral movement across multiple segments
  • Ransomware affecting critical infrastructure or safety systems
  • Widespread encryption across 50+ systems
  • Backup systems compromised or encrypted

HIGH (P2)

  • Multiple systems affected (10-49 systems)
  • Business-critical data at risk but operations continue
  • Limited lateral movement detected
  • Single department or business unit impacted
  • Backup systems accessible and intact
  • Containment partially successful

MEDIUM (P3)

  • Small number of systems affected (5-9 systems)
  • Non-critical systems encrypted
  • No evidence of lateral movement
  • Successful immediate containment
  • Minimal business disruption
  • Full backup coverage available

LOW (P4)

  • Single endpoint affected
  • Immediately isolated with no spread
  • Non-sensitive data involved
  • User-level infection only
  • No business impact
  • Easy recovery from backup

False Positive Handling

If investigation determines the alert is a false positive:

  1. Document findings and rationale in incident ticket
  2. Identify root cause of false positive (detection rule, behavioral analysis)
  3. Tune detection rules to reduce future false positives
  4. Update knowledge base with false positive pattern
  5. Notify affected users that no security incident occurred
  6. Close ticket with "False Positive" resolution code
  7. Track false positive metrics for detection engineering improvements

Containment

Immediate Containment Actions (Target: 30 minutes from confirmation)

CRITICAL: Do not power off affected systems before volatile memory capture unless necessary to prevent immediate spread.

Phase 1: Isolate Affected Systems

  1. Network Isolation via EDR

    • Use EDR console to network-isolate all confirmed infected endpoints
    • Maintain power to preserve volatile memory evidence
    • Document isolation actions with timestamps in incident ticket
    • Verify isolation success through network connectivity tests

  2. Physical Isolation (if EDR unavailable)

    • Disconnect network cables from affected systems
    • Disable wireless adapters
    • Do NOT power off systems before forensic collection
    • Tag systems with physical labels indicating quarantine status

  3. Identify Patient Zero

    • Review EDR timeline to determine first infected system
    • Analyze process creation and network connection chronology
    • Determine initial infection vector:
      • Phishing email attachment or link
      • RDP brute force or compromised credentials
      • Exploited vulnerability (VPN, web application)
      • Malicious software download
      • Removable media (USB)
      • Supply chain compromise

Phase 2: Account and Access Control

  1. Disable Compromised User Accounts

    • Immediately disable Active Directory accounts for affected users
    • Revoke all active sessions and authentication tokens
    • Disable service accounts if compromised
    • Document all account actions in incident log
    • Notify affected users through alternate communication channel

  2. Reset Credentials

    • Reset passwords for all compromised accounts
    • Enforce MFA on all privileged accounts if not already enabled
    • Reset API keys and service account credentials
    • Invalidate stored credentials and cached passwords
    • Issue temporary credentials through secure channel

  3. Restrict Privileged Access

    • Revoke administrative privileges from compromised accounts
    • Review and audit all privileged account activity
    • Enable enhanced logging for administrative actions
    • Require re-authentication for sensitive operations

Phase 3: Network-Level Containment

  1. Block Malicious Network Indicators

    • Add C2 domains and IP addresses to firewall deny lists
    • Block at perimeter firewall, internal firewalls, and proxy
    • Add malicious file hashes to email gateway and web proxy
    • Update IDS/IPS signatures for known ransomware variants
    • Block TOR exit nodes if not required for business operations

  2. Implement Network Segmentation

    • Isolate affected VLANs from rest of network
    • Implement emergency Access Control Lists (ACLs)
    • Disable inter-VLAN routing for affected segments
    • Create network DMZ for forensic investigation systems
    • Document all network changes for rollback

  3. Disable High-Risk Protocols

    • Disable SMB v1 across the environment if still enabled
    • Restrict RDP access to jump hosts or bastion servers only
    • Block or restrict WMI and PowerShell remoting
    • Disable administrative shares (C$, ADMIN$, IPC$) where possible
    • Implement just-in-time (JIT) access for remote administration

Phase 4: Backup Protection

  1. Secure Backup Systems

    • Verify backup system integrity and accessibility
    • Disconnect online backups from production network
    • Create additional offline backups of critical data immediately
    • Move backup media to physically secure location
    • Document backup status, retention periods, and recovery points
    • Test backup restoration in isolated environment

  2. Verify Backup Integrity

    • Scan backup sets for ransomware indicators
    • Verify backup files are not encrypted
    • Test restoration of sample files
    • Document last known good backup timestamp
    • Identify backup sets safe for restoration

Short-Term Containment (Target: 2-4 hours)

  1. Threat Hunting for Additional Compromises

    • Hunt for indicators of compromise (IoCs) across all systems
    • Search for ransomware file hashes, IP addresses, domains
    • Query EDR for suspicious process execution patterns
    • Review authentication logs for unauthorized access
    • Check for persistence mechanisms (scheduled tasks, registry keys, services)

  2. Memory and Disk Forensics

    • Capture volatile memory from infected systems
    • Create forensic disk images of patient zero
    • Preserve evidence following chain of custody procedures
    • Store forensic images on write-protected media
    • Document all forensic collection activities

  3. Enhance Monitoring

    • Deploy additional sensors to critical systems
    • Increase logging verbosity for affected segments
    • Implement enhanced alerting for ransomware indicators
    • Monitor for reinfection attempts
    • Track attacker infrastructure for activity changes

  4. Harden Unaffected Systems

    • Apply emergency security patches to vulnerable systems
    • Deploy additional endpoint protection measures
    • Disable unnecessary services and protocols
    • Implement application whitelisting where feasible
    • Update antivirus signatures and EDR policies

Eradication

Ransomware Identification and Analysis

  1. Identify Ransomware Variant

    • Submit suspicious files to malware analysis sandbox
    • Upload samples to VirusTotal (carefully, consider data sensitivity)
    • Identify ransomware family using threat intelligence
    • Check ID Ransomware (https://id-ransomware.malwarehunterteam.com/)
    • Review ransom note for attribution indicators
    • Document ransomware variant and version

  2. Check for Decryption Tools

    • Search No More Ransom Project (https://www.nomoreransom.org/)
    • Review Emsisoft decryption tools
    • Consult with cybersecurity vendors
    • Evaluate feasibility of decryption without payment
    • Document whether decryption tools exist and are viable

  3. Collect Indicators of Compromise (IoCs)

    • Extract file hashes (MD5, SHA1, SHA256)
    • Document C2 IP addresses and domains
    • Identify mutexes and registry artifacts
    • Note file paths and naming conventions
    • Record network traffic patterns
    • Compile IoCs for threat intelligence sharing

Malicious Artifact Removal

  1. Remove Ransomware Executables

    • Delete ransomware binaries from all affected systems
    • Remove dropped files in temp directories
    • Delete ransom note files
    • Remove encryption keys left by ransomware (if applicable)
    • Clear browser download history and cache

  2. Eliminate Persistence Mechanisms

    • Remove malicious scheduled tasks
    • Delete registry Run keys and startup items
    • Remove malicious services
    • Eliminate WMI event subscriptions
    • Delete malicious drivers
    • Remove DLL hijacking artifacts

  3. Clean Compromised Web Applications

    • Remove web shells from web servers
    • Delete backdoor PHP/ASP/JSP files
    • Review and restore modified legitimate files
    • Check for SQL injection artifacts in databases
    • Review application logs for tampering

  4. Perform Full System Scans

    • Run full antivirus/EDR scans on all affected systems
    • Use multiple scanning engines for validation
    • Deploy specialized ransomware removal tools
    • Scan with offline bootable rescue media
    • Validate complete malware removal

Address Initial Access Vector

  1. Patch Exploited Vulnerabilities

    • Identify exploited CVEs from forensic analysis
    • Apply security patches immediately to affected systems
    • Deploy patches enterprise-wide for same vulnerabilities
    • Conduct vulnerability scan to verify patch deployment
    • Update vulnerability management tracking

  2. Remediate Configuration Weaknesses

    • Close unauthorized open ports
    • Disable unused services
    • Remove weak or default credentials
    • Implement principle of least privilege
    • Harden system configurations per security baselines

  3. Block Phishing Infrastructure

    • Add phishing sender domains to email blocklist
    • Update email filtering rules and policies
    • Block malicious URLs at web proxy
    • Deploy anti-phishing training to affected users
    • Report phishing infrastructure to authorities

  4. Secure Remote Access

    • Close unauthorized remote access channels
    • Remove unauthorized RMM tools
    • Implement MFA on all remote access points
    • Restrict RDP to jump servers only
    • Deploy VPN with certificate-based authentication

System Cleanup and Validation

  1. Consider System Reimaging

    • Evaluate whether reimaging is more reliable than cleaning
    • For severely compromised systems, always reimage
    • For domain controllers and critical infrastructure, prefer reimaging
    • Use verified clean installation media
    • Document reimaging decisions and rationale

  2. Network Infrastructure Cleanup

    • Clear ARP and DNS caches network-wide
    • Review and remove unauthorized firewall rules
    • Audit VPN configurations and accounts
    • Review proxy logs for data exfiltration
    • Validate network segmentation remains intact

  3. Validate Eradication

    • Rescan all systems with multiple security tools
    • Perform memory forensics to confirm no malware remains
    • Monitor for 48-72 hours for reinfection signs
    • Conduct penetration testing to validate remediation
    • Obtain security team sign-off before recovery phase

Recovery

Pre-Recovery Validation

  1. Confirm Complete Eradication

    • Verify no ransomware artifacts remain
    • Confirm attacker access has been eliminated
    • Validate all IoCs have been addressed
    • Ensure no backdoors or persistence mechanisms remain
    • Obtain Incident Commander approval to proceed

  2. Verify Backup Integrity

    • Confirm backups are not encrypted or corrupted
    • Validate backup sets are from before infection
    • Test backup restoration in isolated test environment
    • Scan restored data for malware
    • Document backup validation results

System Restoration Process

Priority Order:

  1. Critical business systems (e.g., ERP, email, file servers)

  2. Production infrastructure (databases, application servers)

  3. Supporting infrastructure (authentication, DNS, DHCP)

  4. User endpoints (workstations, laptops)

  5. Restore from Clean Backups

    • Restore systems from last verified clean backup
    • Validate data integrity post-restoration
    • Apply all security patches before network reconnection
    • Implement additional hardening configurations
    • Test system functionality in isolated environment first
    • Document restoration timeline and success metrics

  6. Rebuild Compromised Systems

    • Reimage systems that cannot be reliably cleaned
    • Install operating system from verified clean media
    • Apply all current security patches and updates
    • Install approved software only
    • Configure according to hardened security baselines
    • Validate system before production deployment

  7. Restore Data Files

    • Prioritize business-critical data restoration
    • Restore files from pre-infection backup point
    • Validate file integrity and accessibility
    • Scan restored data with updated antivirus
    • Compare restored data against business requirements
    • Document any data loss or gaps

Credential Management

  1. Reset All Credentials

    • Force password reset for all domain accounts
    • Reset service account passwords
    • Regenerate API keys and application secrets
    • Update stored credentials in password vaults
    • Reset SSH keys and certificates
    • Invalidate all existing authentication tokens

  2. Reissue Certificates

    • Revoke and reissue TLS/SSL certificates if compromised
    • Update code signing certificates
    • Rotate encryption keys
    • Update VPN certificates
    • Document certificate management actions

Phased Reconnection to Network

  1. Isolated Testing Environment

    • Deploy restored systems to isolated test network first
    • Validate functionality without production connectivity
    • Monitor for 24-48 hours for any suspicious activity
    • Conduct security scans and penetration tests
    • Verify no reinfection occurs

  2. Gradual Production Reconnection

    • Reconnect systems in phases starting with critical infrastructure
    • Monitor EDR and SIEM closely during reconnection
    • Implement enhanced logging and alerting
    • Have rollback plan ready for each phase
    • Document reconnection timeline and issues

  3. User Communication and Training

    • Notify users of system availability
    • Provide instructions for accessing restored systems
    • Conduct mandatory security awareness training
    • Remind users of phishing and social engineering risks
    • Establish feedback channel for user-reported issues

Post-Recovery Monitoring

  1. Enhanced Monitoring Period (30 days minimum)

    • Implement continuous monitoring for reinfection indicators
    • Conduct daily threat hunting activities
    • Review authentication logs for unauthorized access
    • Monitor backup systems for tampering attempts
    • Track anomalous network traffic patterns
    • Document all monitoring findings

  2. User Acceptance Testing

    • Coordinate with business units to validate system functionality
    • Confirm data accessibility and integrity
    • Verify application performance
    • Document any functional gaps or issues
    • Obtain business unit sign-off on recovery

Post-Incident Activities

Incident Documentation

  1. Comprehensive Incident Report

    • Document complete incident timeline with timestamps
    • Record all actions taken during response
    • List affected systems, accounts, and data
    • Document business impact (downtime, data loss, costs)
    • Identify root cause and attack vector
    • Compile all IoCs and forensic findings
    • Estimate financial impact (response costs, business loss, recovery)
    • Store report in secure incident archive

  2. Executive Summary

    • Prepare non-technical summary for leadership
    • Highlight business impact and recovery status
    • Provide recommendations for preventing recurrence
    • Include cost estimates for remediation efforts
    • Present at executive briefing

Lessons Learned Session

  1. Post-Incident Review Meeting

    • Schedule within 7 days of incident closure
    • Include all response team members and stakeholders
    • Review what went well and what needs improvement
    • Identify gaps in detection, response, or recovery
    • Discuss communication effectiveness
    • Document action items with owners and due dates

  2. Identify Improvement Areas

    • Technical control deficiencies
    • Process or procedural gaps
    • Training or awareness needs
    • Insufficient resources or tools
    • Communication breakdowns
    • Backup and recovery challenges

Remediation and Improvement

  1. Update Detection Rules

    • Create new SIEM correlation rules based on attack patterns
    • Update EDR policies and behavioral analytics
    • Deploy custom YARA rules for identified ransomware
    • Enhance network intrusion detection signatures
    • Test new detection rules in non-production environment
    • Document rule effectiveness metrics

  2. Implement Technical Improvements

    • Deploy additional security controls identified during response
    • Enhance network segmentation
    • Implement application whitelisting
    • Deploy deception technology (honeypots, canary tokens)
    • Upgrade endpoint protection capabilities
    • Improve backup and disaster recovery architecture

  3. Update Incident Response Procedures

    • Revise this SOP based on lessons learned
    • Update contact lists and escalation matrices
    • Refine playbooks and runbooks
    • Create new procedures for identified gaps
    • Conduct tabletop exercises to validate changes

  4. Security Awareness Training

    • Conduct organization-wide security awareness training
    • Focus on phishing and social engineering prevention
    • Train users on recognizing ransomware symptoms
    • Provide reporting procedures for suspicious activity
    • Conduct phishing simulation campaigns
    • Track training completion and effectiveness metrics

Compliance and Legal

  1. Regulatory Notifications

    • Determine if breach notification is required
    • Notify affected individuals per GDPR, CCPA, or other regulations
    • File required reports with regulatory agencies
    • Coordinate with legal counsel on all notifications
    • Document all compliance-related activities

  2. Law Enforcement Coordination

    • File report with FBI Internet Crime Complaint Center (IC3)
    • Coordinate with local law enforcement if appropriate
    • Share IoCs with FBI, CISA, and ISACs
    • Preserve evidence for potential prosecution
    • Document all law enforcement interactions

  3. Cyber Insurance Claim

    • Notify cyber insurance carrier immediately
    • Provide required documentation and forensic reports
    • Coordinate with insurance-approved vendors
    • Track all incident-related expenses
    • Follow claim process per policy requirements

Threat Intelligence Sharing

  1. Share IoCs with Community
    • Submit IoCs to MISP, ThreatConnect, or similar platforms
    • Share anonymized attack details with ISACs/ISAOs
    • Contribute to industry threat intelligence
    • Report to No More Ransom Project if decryption achieved
    • Coordinate with legal before external sharing

Escalation Criteria

Escalate from L1 to L2 when:

  • Ransomware infection is confirmed (not false positive)
  • Multiple systems show signs of infection
  • Initial containment actions are insufficient
  • Ransomware variant is unknown or unusual
  • User credentials are confirmed compromised
  • Lateral movement is detected
  • Incident exceeds L1 analyst authority or expertise

Escalate from L2 to L3/IR Team when:

  • More than 10 systems are affected
  • Critical business systems are encrypted
  • Backup systems are compromised or inaccessible
  • Active data exfiltration is detected (double extortion)
  • Advanced persistent threat (APT) involvement is suspected
  • Root cause cannot be determined by L2
  • Eradication efforts are unsuccessful
  • Incident duration exceeds 4 hours without resolution
  • Severity is assessed as HIGH or CRITICAL

Escalate to Management/Executive when:

  • Incident severity is CRITICAL (P1)
  • Core business operations are disrupted
  • Significant financial impact is projected (>$100K)
  • Ransom payment consideration is necessary
  • Data breach notification may be required
  • Media or public relations response is needed
  • Cyber insurance claim will be filed
  • Law enforcement engagement is recommended
  • Third-party vendor breach affects organization

Escalation Procedure:

  1. Document all findings and actions taken in incident ticket
  2. Notify escalation point via phone call (not just email/chat)
  3. Provide verbal briefing of current situation
  4. Share access to incident documentation and forensic data
  5. Remain available to assist higher-tier responders
  6. Continue monitoring and containment during transition
  7. Document escalation timestamp and receiving party

Emergency Contact Information:

  • SOC Manager: [Phone] [Email]
  • Incident Response Team Lead: [Phone] [Email]
  • CISO: [Phone] [Email]
  • IT Director: [Phone] [Email]
  • Legal Counsel: [Phone] [Email]
  • External IR Firm: [Phone] [Email]
  • Cyber Insurance: [Phone] [Policy Number]

References

Industry Frameworks and Standards

  • NIST Cybersecurity Framework (CSF)
  • NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide
  • SANS Incident Handler's Handbook
  • ISO/IEC 27035: Information Security Incident Management
  • MITRE ATT&CK Framework: Ransomware Techniques
  • CIS Controls for Ransomware Prevention and Response

Threat Intelligence Resources

  • FBI Internet Crime Complaint Center (IC3): https://www.ic3.gov
  • CISA Ransomware Guide: https://www.cisa.gov/stopransomware
  • No More Ransom Project: https://www.nomoreransom.org
  • ID Ransomware: https://id-ransomware.malwarehunterteam.com
  • Ransomware Tracker: https://ransomwaretracker.abuse.ch
  • MITRE ATT&CK: https://attack.mitre.org

Internal Documentation

  • Enterprise Incident Response Plan
  • Business Continuity and Disaster Recovery Plan
  • Data Classification and Handling Policy
  • Acceptable Use Policy
  • Change Management Procedures
  • Forensic Collection and Evidence Handling Procedures
  • Crisis Communication Plan
  • Vendor Management and Third-Party Risk Policy

External Resources

  • Cyber Insurance Policy Documentation
  • Incident Response Retainer Agreement (if applicable)
  • Legal Counsel Contact Information
  • Forensic Investigation Partner Contacts
  • Backup and Recovery Service Provider Documentation

Follow CyberHawk for More Threat Intelligence and Cybersecurity Content

Stay updated with the latest cybersecurity insights, threat intelligence, and incident response best practices:

#cyberhawkthreatintel #cyberhawkconsultancy

Document Control:

  • Owner: Security Operations Center
  • Approver: Chief Information Security Officer
  • Classification: Internal Use Only

This SOP should be reviewed and updated annually or after each ransomware incident to incorporate lessons learned and evolving threat landscape changes.

Labels:

Comments

Post a Comment