Executes structured ransomware incident recovery following NIST/CISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory/database recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.
Executes structured ransomware incident recovery following NIST/CISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory/database recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.
{"version":"1.1","tactics":["positioning","monetization","defense-impairment"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"defense-impairment","source":"f3"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"}]}
Recovering from Ransomware Attack
When to Use
After ransomware has encrypted production systems and the decision has been made to recover from backups
When building or validating a ransomware recovery runbook before an actual incident
After receiving a decryption key (paid ransom or law enforcement provided) and needing to safely decrypt
When partial recovery is needed alongside decryption of remaining systems
Conducting a recovery drill to validate RTO commitments
Do not use before completing containment and forensic scoping. Premature recovery without understanding the attacker's access and persistence mechanisms risks re-infection.
Prerequisites
Incident declared and containment phase completed (all attacker access severed)
Phase 1: Reconnect identity infrastructure
- DCs online in production VLAN
- Validate replication and authentication
- Monitor for suspicious authentication patterns
Phase 2: Reconnect Tier 1 systems
- One system at a time
- Monitor EDR for 1 hour before proceeding to next
- Validate application functionality
Phase 3: Reconnect remaining systems
- Groups of 5-10 systems
- Continue monitoring for re-infection indicators
Throughout: SOC monitoring on high alert
- EDR in aggressive blocking mode
- All previous IOCs loaded in detection rules
- Canary files deployed on recovered systems
Key Concepts
Term
Definition
DSRM
Directory Services Restore Mode: special boot mode for domain controllers that allows AD database restoration
krbtgt Reset
Resetting the krbtgt account password twice invalidates all Kerberos tickets, defeating Golden Ticket persistence
Instant Recovery
Backup technology that boots a VM directly from backup storage for immediate availability while migrating data in background
Evidence Preservation
Maintaining forensic images and logs before recovery begins, required for law enforcement and insurance claims
Clean Build
Rebuilding systems from trusted installation media rather than attempting to clean infected systems
Dependency Chain
The order in which systems must be recovered based on service dependencies (e.g., AD before domain members)
Tools & Systems
Veeam Instant Recovery: Boots VMs directly from backup with near-zero RTO, then live-migrates to production
Microsoft DSRM: AD-specific recovery mode for restoring domain controllers from backup
DSInternals PowerShell Module: Validates AD database integrity and identifies compromised credentials post-recovery
Rubrik Instant Recovery: Mounts backup as live VM in seconds for rapid recovery validation
ClamAV: Open-source antivirus for scanning backup files before restoration
Common Scenarios
Scenario: Manufacturing Company Full Recovery After LockBit Attack
Context: A manufacturer with 300 servers has 80% of infrastructure encrypted by LockBit. Immutable backups from 48 hours ago are verified clean. Production lines are down, costing $500K/day.
Approach:
Establish recovery VLAN (10.99.0.0/24) isolated from compromised network
Restore 2 domain controllers from immutable backup using Veeam Instant Recovery (2 hours)
Reset krbtgt password twice with 12-hour gap, reset all admin passwords
Validate AD with dcdiag, scan for Golden Ticket indicators with DSInternals
Restore ERP database (SAP) and verify data consistency (4 hours)
Restore MES (Manufacturing Execution System) and SCADA historians (3 hours)
Bring production line controllers online in isolated OT network first
Phased reconnection over 48 hours with continuous EDR monitoring
Total recovery: 72 hours (within 96-hour RTO commitment)
Pitfalls:
Rushing to reconnect systems without validating absence of persistence mechanisms, causing re-infection
Restoring from the most recent backup without verifying it predates the compromise (attacker may have poisoned recent backups)
Not resetting the krbtgt password twice, allowing attackers to maintain Golden Ticket access
Restoring systems in the wrong order (application servers before their database dependencies)
