ArcanaIncident-response documentationBrowse the feedTemplates
Back to feed
Playbook
PB-002

Ransomware Incident Response

1. Purpose & Scope

  • Purpose:

    This playbook outlines the end-to-end response process for ransomware incidents, including containment, scoping, eradication, recovery, and post-incident hardening.

  • Scope:

    Applies to all ransomware-related incidents across the organisation, including:

    • Endpoint ransomware
    • Server encryption events
    • Hypervisor / ESXi ransomware
    • Double extortion incidents
    • Large-scale enterprise encryption activity

2. Incident Identification & Criteria

Incident Type: Ransomware

Trigger Conditions:

Initiate this playbook when any of the following occur:

  • Ransom note detected
  • Sudden file extension changes observed
  • EDR ransomware alert triggered
  • Multiple systems simultaneously encrypted
  • Backup deletion activity detected
  • ESXi or hypervisor encryption identified
  • Mass file rename/write activity detected

Severity Levels:

SeverityDescription
Sev 3Suspected ransomware activity on a single endpoint, not yet confirmed
Sev 2Confirmed ransomware on a single isolated system with no observed propagation
Sev 1Confirmed ransomware impacting multiple systems or a business-critical service
Sev 0Enterprise-wide propagation, hypervisor/backup compromise, or critical infrastructure impact

3. Roles & Responsibilities

  • Incident Commander: Coordinates and leads the response to the ransomware incident; drives decisions and timelines; ensures containment, communications, and remediation actions are executed.
  • Communications Lead: Manages internal and external communications, executive updates, customer/regulator notifications, and stakeholder messaging.
  • Incident Responder/Forensic Analyst: Performs forensic analysis of impacted hosts, ransomware payload analysis, identifies patient zero, maps the attack timeline, and preserves evidence.
  • Other Roles:
    • Identity & Access Team: Supports Active Directory containment, privileged account review, session revocation, and credential resets.
    • Network/Infrastructure Team: Executes network segmentation, host isolation, and protects critical infrastructure.
    • Backup & Recovery Team: Validates backup integrity, isolates backup infrastructure, and coordinates restoration.
    • Legal & Compliance: Assesses regulatory obligations, breach notification requirements, and ransom payment considerations.
    • Executive Leadership / Crisis Management: Approves major business decisions, authorises external communications, and coordinates with law enforcement where required.

4. Initial Actions

  • Immediate Steps:

    • Perform rapid containment & segmentation - isolate affected systems and disable lateral movement pathways (restrict SMB, remote admin protocols)
    • Notify Incident Response leadership and assign roles
    • Preserve volatile evidence where feasible (avoid additional system shutdowns or reboots unless required)
    • Identify critical business systems impacted
    • Freeze non-essential administrative changes

    Decision Point:

5. Investigation & Analysis

  • Evidence Collection:
    • For all newly identified infected hosts:
      • collect the following host telemetry over the incident window:
        • Process execution - focus on encryption binaries, backup/shadow-copy deletion and unexpected use of admin/archive tools (e.g tar, zip, WinRar)
        • File system events - mass writes/renames, ransom note creation, backup/shadow deletion
        • Script & interpreter activity - encoded/obfuscated PowerShell, bash, zsh, python; LOLBins
        • Authentication / logon - lateral movement over RDP, SSH, SMB
        • Persistence - scheduled tasks, cron, services/daemons, launch agents, autoruns
        • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
      • capture a full memory snapshot to preserve volatile artefacts before any reboot, reimage, or shutdown
  • Analysis Steps:

    Decision Point: For each identified initial access vector, run the post-detection phases (Analysis → Recovery) of the relevant playbook concurrently alongside this one:

    Decision Point:

    • If backup compromise identified → immediate executive escalation.

    Decision Point:

    • Map threat actor TTPs, correlate with known ransomware groups, and update detections/threat intelligence

6. Containment, Eradication & Recovery

Warning: Do NOT begin large-scale restoration activities until:

  • Containment is verified
  • Persistence mechanisms are identified
  • Privileged access has been reviewed
  • Propagation paths are understood
  • Backup integrity is validated

Premature restoration may result in reinfection or repeated encryption.

7. Communication & Escalation

  • Internal Communication:

    • Notify executive leadership and affected business units
    • Provide regular incident updates to leadership and impacted teams
    • Issue org-wide advisory if propagation is broad or critical services are impacted

  • External Communication:

  • Escalation Criteria:

ConditionEscalate To
Phishing identified as initial access vectorPB-001: Phishing & Credential Theft
Account takeover identified as initial access vectorPB-004: Account Takeover
Zero-day vulnerability exploited as initial access vectorPB-018: Zero-Day Response
Known/patched vulnerability exploited as initial access vectorPB-017: Vulnerability Response
Data exfiltration confirmedPB-005: Data Exfiltration
Enterprise-wide propagation, hypervisor or backup compromisePB-019: Major Security Incident Management / Executive escalation

8. Post-Incident Activities

  • Lessons Learned:

    • Schedule and conduct a Post-Incident Review (PIR)
    • Document what went well and what needs improvement
    • Review control failures (detection, segmentation, privileged access, backup protection)
    • Identify and close detection gaps

  • Documentation Updates:

    • Update this playbook, linked runbooks, and KB articles to reflect lessons learned
    • Update detections and threat intelligence based on observed TTPs
    • Harden segmentation, privileged access, and backup protections

9. References & Linked Resources

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.