Skip to content
MIMIR

Ransomware Outbreak & Containment Playbook

Standard Operating Procedure for containment and triage during an active ransomware outbreak or precursor deployment (e.g. Cobalt Strike, Qakbot, BlackCat/ALPHV, LockBit).

🛑 Golden Hour Action Priorities (< 30 Minutes)

Section titled “🛑 Golden Hour Action Priorities (< 30 Minutes)”
+-------------------------------------------------------------------------+
| DO NOT IMMEDIATELY POWER OFF OR REBOOT AFFECTED ENDPOINTS!             |
| 1. Powering off destroys volatile RAM containing unbacked decryptor    |
|    keys, C2 IPs, and loaded payloads.                                   |
| 2. Instead: Disconnect network cable / Isolate via EDR.                 |
+-------------------------------------------------------------------------+

⚡ 1. Host Isolation Procedures

Section titled “⚡ 1. Host Isolation Procedures”

Option A: Microsoft Defender for Endpoint (MDE) API Isolation

Section titled “Option A: Microsoft Defender for Endpoint (MDE) API Isolation”

Immediately cut off external and internal network connectivity while preserving EDR communication.

// Quick query to locate active DeviceId for isolation command
DeviceInfo
| where DeviceName =~ "TargetHost"
| project DeviceId, DeviceName, PublicIP, LoggedOnUsers, OSPlatform

Option B: PowerShell Network Adapter Quarantine (Local / GPO)

Section titled “Option B: PowerShell Network Adapter Quarantine (Local / GPO)”

If EDR is unresponsive, disable non-management adapters or block all outbound traffic via local firewall.

Terminal window
# Block all outbound traffic except specific IR jumpbox
New-NetFirewallRule -DisplayName "EMERGENCY_ISOLATE_ALL" -Direction Outbound -Action Block -Profile Any
New-NetFirewallRule -DisplayName "EMERGENCY_ALLOW_IR" -Direction Outbound -Action Allow -RemoteAddress "10.0.0.50" -Profile Any

🧱 2. Sever Lateral Movement Channels at Firewalls & Core Switches

Section titled “🧱 2. Sever Lateral Movement Channels at Firewalls & Core Switches”

Immediately block or restrict typical lateral movement ports between client workstations and across VLANs:

PortProtocolPurposeEmergency Containment Action
445SMBLateral spread, PsExec, file sharingBlock workstation-to-workstation SMB
135RPC / WMIRemote process executionRestrict client-to-client RPC / enforce host isolation
3389RDPInteractive GUI hoppingEnforce MFA, disconnect non-vital sessions
5985 / 5986WinRMRemote PowerShell commandsRestrict to authorized administrative endpoints

🪓 3. Detecting Shadow Copy & Backup Destruction

Section titled “🪓 3. Detecting Shadow Copy & Backup Destruction”

Ransomware operators consistently destroy Volume Shadow Copies before launching encryption routines.

KQL Query: Hunt for VSS Deletion Commands

Section titled “KQL Query: Hunt for VSS Deletion Commands”
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (
    "vssadmin delete shadows",
    "wmic shadowcopy delete",
    "wbadmin delete catalog",
    "bcdedit /set {default} bootstatuspolicy ignoreallfailures",
    "bcdedit /set {default} recoveryenabled no",
    "cipher /w"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

💾 4. Rapid Volatile Memory Preservation

Section titled “💾 4. Rapid Volatile Memory Preservation”

Before any reboot or cleanup, capture physical RAM on patient-zero or affected cloud workloads:

Terminal window
# Run WinPmem / DumpIt to an isolated external storage drive (e.g. E:\)
.\winpmem.exe -o "E:\Forensics\RAM_PatientZero.raw"

📋 5. Entra ID & Cloud Tenant Credential Lockdown

Section titled “📋 5. Entra ID & Cloud Tenant Credential Lockdown”

If cloud identity compromise or cross-workload lateral movement is suspected:

  1. Revoke Active Cloud Sessions Tenant-Wide:
    • Invalidate all refresh tokens via Microsoft Graph (Revoke-MgUserSignInSession) for affected users and all Global Administrators.
  2. Lockdown Privileged Identity Management (PIM):
    • Terminate all active PIM elevations and enforce secondary approval for new elevation requests.
  3. Audit Service Principal Credentials:
    • Check Entra ID Audit Logs for client secrets or certificates added to Enterprise Apps in the last 7 days.
  4. Enforce Conditional Access Token Revocation:
    • Verify Continuous Access Evaluation (CAE) triggers immediate token revocation upon location or risk change.

🛡️ 6. Post-Containment Recovery Milestones

Section titled “🛡️ 6. Post-Containment Recovery Milestones”
[ ] Step 1: Confirm C2 communication is severed via firewall egress drops.
[ ] Step 2: Validate integrity of offline / immutable backups (verify air-gap).
[ ] Step 3: Identify patient-zero and weaponization vector (e.g. unpatched VPN, phishing).
[ ] Step 4: Deploy out-of-band communication for incident handling team.
[ ] Step 5: Restore systems to a quarantined clean VLAN for staging verification.