recovering-from-ransomware-attack

name	recovering-from-ransomware-attack
description	Executes structured ransomware incident recovery following NIST/CISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory/database recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.
domain	cybersecurity
subdomain	ransomware-defense
tags	["ransomware","recovery","incident-response","backup","defense"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"]
mitre_attack	["T1078","T1190","T1059","T1003","T1110"]
mitre_f3	{"version":"1.1","tactics":["positioning","monetization","defense-impairment"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"defense-impairment","source":"f3"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"}]}

Recovering from Ransomware Attack

When to Use

• After ransomware has encrypted production systems and the decision has been made to recover from backups
• When building or validating a ransomware recovery runbook before an actual incident
• After receiving a decryption key (paid ransom or law enforcement provided) and needing to safely decrypt
• When partial recovery is needed alongside decryption of remaining systems
• Conducting a recovery drill to validate RTO commitments

Do not use before completing containment and forensic scoping. Premature recovery without understanding the attacker's access and persistence mechanisms risks re-infection.

Prerequisites

• Incident declared and containment phase completed (all attacker access severed)
• Forensic evidence preserved (disk images, memory dumps, network captures)
• Backup integrity verified (immutable/air-gapped copies confirmed clean)
• Clean build media available (OS installation media, golden images)
• Recovery environment prepared (clean network segment isolated from compromised infrastructure)
• Recovery priority list documented (Tier 1/2/3 systems in dependency order)

Workflow

Step 1: Establish Clean Recovery Environment

Build recovery infrastructure isolated from the compromised network:

# Create isolated recovery VLAN
# No connectivity to compromised network segments
# Dedicated internet access for patch downloads only (via proxy)

# Recovery network architecture:
# VLAN 999 (Recovery) - 10.99.0.0/24
#   - Recovery workstations (10.99.0.10-20)
#   - Recovered DCs (10.99.0.50-55)
#   - Recovered servers (10.99.0.100+)
#   - Proxy for internet (10.99.0.1) - patches and updates only

# Firewall rules: DENY all from recovery VLAN to production VLANs
# Allow: Recovery VLAN -> Internet (HTTPS only, via proxy)
# Allow: Recovery VLAN -> Backup infrastructure (restore traffic only)

Step 2: Recover Identity Infrastructure First

Active Directory must be recovered before any domain-joined systems:

# AD Recovery Procedure
# Step 2a: Restore AD from known-good backup
# Use DSRM (Directory Services Restore Mode) boot

# 1. Build clean Windows Server from ISO
# 2. Promote as DC using AD restore
# 3. Restore System State from immutable backup

# Verify AD backup is pre-compromise
# Check backup timestamp against earliest known compromise date
wbadmin get versions -backuptarget:E: -machine:DC01

# Restore system state in DSRM
wbadmin start systemstaterecovery -version:02/15/2026-04:00 -backuptarget:E: -machine:DC01 -quiet

# After restore, reset critical accounts
# Reset krbtgt password TWICE (invalidates all Kerberos tickets)
# This prevents Golden Ticket persistence
Import-Module ActiveDirectory
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewKrbtgt2026!Complex#1" -AsPlainText -Force)
# Wait for replication (minimum 12 hours), then reset again
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewKrbtgt2026!Complex#2" -AsPlainText -Force)

# Reset all privileged account passwords
$privilegedGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators")
foreach ($group in $privilegedGroups) {
    Get-ADGroupMember -Identity $group -Recursive | ForEach-Object {
        Set-ADAccountPassword -Identity $_.SamAccountName -Reset `
            -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force)
        Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true
    }
}

# Validate AD health
dcdiag /v /c /d /e /s:DC01
repadmin /showrepl