First 15 minutes. Before you touch this checklist: isolate the confirmed host (pull the network cable or disable the switch port, do NOT power off). Preserve volatile memory if you have the tooling. Then start here.
Phase 1: Contain and scope (first hour)
- 1. Identify the ransomware family Ransom note filename, file extension, note content. Check ID Ransomware or No More Ransom. The family tells you: is a decryptor available, what's the typical dwell time, do they exfiltrate, and what deployment method they use. This drives every decision downstream.
- 2. Scope the blast radius How many hosts have encrypted files? Check network shares for ransomware extensions and ransom notes. Query the SIEM for the encryption process name across all hosts. The first host you found is almost never the only one. NET: T1021.002 SMB lateral · Security EID 5145 (share access)
- 3. Find the deployment mechanism How did the encryption binary get to each host? The three most common: PsExec via ADMIN$ (Sysmon EID 13 service creation, EID 17/18 named pipes), Group Policy scheduled task (check SYSVOL for suspicious .bat/.ps1), or WMI remote execution (WmiPrvSE child processes). HOST: T1021.002 PsExec · T1047 WMI
- 4. Check shadow copies and recovery state Were shadow copies deleted? vssadmin, bcdedit, wbadmin in Sysmon EID 1. If shadows were deleted before encryption started, you have a timeline anchor: the deletion timestamp is the start of the attack's final phase. HOST: T1490 Inhibit System Recovery
- 5. Identify which services were killed Bulk net stop / sc stop / taskkill targeting AV, backup agents, databases. The specific service list can attribute the ransomware family (Conti, REvil, BlackMatter each have documented kill lists). System EID 7036 shows every service state change. HOST: T1489 Service Stop
Phase 2: Reconstruct the timeline (hours 2-8)
- 6. Find the initial access point Work backward from the deployment host. Common entry vectors: compromised VPN/RDP credentials (EID 4624 type 10 from unexpected source), phishing email with maldoc (EID 1 Office child process), or exploited edge device. The entry point is usually days or weeks before the encryption. NET: Initial Access · Security EID 4624/4625
- 7. Map the credential access chain What credentials did they steal and how? LSASS dumps (Sysmon EID 10 targeting lsass.exe), SAM/NTDS extraction (reg save commands), DCSync (EID 4662 with replication GUIDs), Kerberoasting (EID 4769 with RC4 etype). The credential chain reveals which accounts are burned. HOST: T1003.001 LSASS · T1003.006 DCSync · T1558.003 Kerberoast
- 8. Trace lateral movement Map every host the attacker touched. PsExec service creation artifacts, RDP type 10 logons, WMI WmiPrvSE child processes, SSH authorized_keys additions. Build the movement timeline: which host was compromised when, in what order, using which credentials. HOST: Lateral Movement (all techniques)
- 9. Reconstruct the data exfiltration Did they steal data before encrypting? 70%+ of modern ransomware operations include data theft. Check: Rclone, MEGAcmd, or cloud sync tool execution (Sysmon EID 1). Large outbound transfers in proxy/firewall logs. Archive creation (7z, rar, zip) of sensitive directories. DNS tunneling or HTTPS to cloud storage IPs. NET: Exfiltration · C2
- 10. Identify persistence mechanisms The attacker almost certainly left backdoors beyond the ransomware itself. Check: new services, scheduled tasks, SSH authorized_keys, registry Run keys, WMI event subscriptions. If you rebuild without clearing persistence, they come back. HOST: Persistence (all techniques)
Phase 3: Recovery decisions
- 11. Assess backup integrity Are backups available? Were backup servers/agents compromised? Ransomware operators specifically target Veeam, Commvault, and other backup infrastructure. Check backup server logs for unauthorized access. Offline/immutable backups are the only ones you can trust.
- 12. Check for decryptor availability Some families have free decryptors (No More Ransom project, Emsisoft, Kaspersky). Some families have implementation bugs that allow recovery. The ransomware family ID from step 1 drives this decision.
- 13. Reset ALL credentials before reconnecting Every domain account password. The krbtgt password (twice, 12 hours apart). Every local admin password. Every service account. Every SSH key. If you reconnect rebuilt machines to a domain where the attacker still has valid credentials, you're back to zero.
Typical ransomware timeline
Day 0: Initial access (phishing, VPN creds, exploited appliance). Foothold established.
Days 1-3: Discovery. whoami, systeminfo, net group "Domain Admins". ADFind or BloodHound.
Days 2-5: Credential access. LSASS dump, Kerberoasting, DCSync. Escalation to Domain Admin.
Days 3-7: Lateral movement to high-value targets. Domain controllers, file servers, backup servers.
Days 5-10: Data exfiltration. Rclone to cloud storage, 7z archives staged and exfiltrated.
Day 7-14: Ransomware deployment. Shadow copy deletion, service stops, encryption binary pushed via PsExec or GPO. Often executed overnight or on weekends.
The exfil question matters most. If they only encrypted, you can rebuild from backups. If they stole data, you have a regulatory notification obligation and the extortion continues even if you restore from backup. Answering "did data leave the network" is more important than "can we decrypt."
ESXi/hypervisor targeting. Ransomware operators increasingly deploy directly on VMware ESXi hosts, encrypting all hosted VMs without triggering guest-level EDR agents. Most endpoint protection runs inside the guest OS, not on the hypervisor. A single ESXi host encrypted means every VM on it is down. Check for: SSH access to ESXi hosts from unexpected sources, new ESXi local accounts, and ransomware binaries compiled as ELF (Linux) targeting the /vmfs/volumes/ datastore paths. If your backup infrastructure also runs as VMs on the same hypervisor, the backups die with everything else.
Breakout time: 29 minutes average, 27 seconds fastest. CrowdStrike's 2026 GTR measured the average eCrime breakout time (initial access to lateral movement) at 29 minutes, a 65% acceleration from 2024. The fastest recorded breakout was 27 seconds. In one intrusion, data exfiltration began within four minutes of initial access. The implication: if your detection and response cycle takes longer than 30 minutes, the attacker is already lateral before you see the first alert.
OT ransomware is being misclassified as IT-only (Dragos 2026). Dragos tracked 119 ransomware groups impacting 3,300+ industrial organizations in 2025 (up from 1,693 in 2024). But the numbers understate the problem. There is a persistent mischaracterization of ransomware incidents as IT-only, driven by responders who see a Windows operating system and classify the incident without recognizing that the system was hosting SCADA software or functioning as an engineering workstation. Manufacturing accounted for 67%+ of all ransomware victims. The operational impact is real even without ICS-specific malware: a Fog affiliate used compromised VPN access to reach an OT-adjacent ESXi hypervisor and encrypt SCADA-supporting virtual machines. No PLCs or field devices were touched, but the loss of the virtualization layer immediately removed operator visibility and control.
Actors who run this playbook
Nearly every ransomware affiliate follows this general pattern. Family-specific variations in tooling and deployment method, but the kill chain is consistent across LockBit, BlackCat/ALPHV, Royal, Play, Cl0p, Akira, and their successors. Lazarus operates Maui ransomware against healthcare. Sandworm deployed NotPetya as destructive ransomware disguised as extortion.