domains / families / security / performing-ransomware-response

performing-ransomware-response

separate

'Executes a structured ransomware incident response from detection through

When to use

• Ransomware has been detected executing or file encryption is actively occurring
• Users report inability to open files with unfamiliar extensions appended
• A ransom note is discovered on one or more systems
• EDR detects mass file modification patterns consistent with encryption behavior
• Threat intelligence warns of an imminent ransomware campaign targeting the organization

When not to use

• general malware incidents that do not involve file encryption or extortion

Skill page

Source