Incident Response
What 19 seconds of containment looks like inside a ransomware precursor
A step-by-step reconstruction of how one security team stopped shadow copy deletion before any file was encrypted.
/ 9 min read
In briefA step-by-step reconstruction of how one security team stopped shadow copy deletion before any file was encrypted.
The first signal was a service account installing a remote execution service on six workstations in four minutes.
Twelve hours later, the same account ran a command to delete shadow copies on a file server. Automated playbooks quarantined the server 19 seconds after detection.
The team credits two decisions: tagging service accounts with expected behaviour, and allowing isolation without a human approval step for tier-1 servers.
Filed under Security OperationsIncident Response
Does this story affect you?
Tell us about your environment and a SentriXa security editor will get back to you within one business day.