Sort The Ransomware Signals
Categorize ransomware-related signals by likely attack phase.
Sort each signal by the phase it most strongly suggests in a ransomware intrusion. Initial access Credential or privilege Lateral movement Collection or exfiltration Impact User clicks malicious attachment and spawns script interpreter Exploit attempt against public VPN appliance Multiple failed MFA prompts followed by successful login New domain admin membership added outside change window PsExec launches from one workstation to eight servers Remote service creation on file server from unusual host 7-Zip archives finance share into 12 large files Outbound transfer spike to unknown cloud storage vssadmin deletes shadow copies on Windows servers Mass file rename with new locked…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in