Observe

• AV engines and EDR alerts help to detect the initial attempt of infection, behavior, or presence of ransomware on endpoint workstations and servers.
• Firewall and proxy logs are used to monitor excessive outbound communication requests.
• Internal firewalls and IPS solutions are used to detect abnormal network behavior and internal malware spreading.
• Endpoints are monitored to identify unique and abnormal processes, encrypted files, and a ransom note that indicates a ransomware infection.
• DLP alerts are monitored to identify data exfiltration attempts.

Enrich

• Through SIEM correlation, outbound communication from an infected host is checked for known artifacts and IoCs.
• EDR and AV detections are inspected for enrichment.
• Identified artifacts are then scanned through OSINT platforms for further enrichment like file reputation, etc.
• AD is queried to gather details of the affected user.
• Additional SIEM logs are checked to see if any other systems are found communicating with the same IoCs.  

Decide

Based on the sensitivity of data and criticality of assets, the security team would take decisions about the severity of the incident. SIRP offers extensive Asset management and prioritization of alerts through its proprietary scoring mechanism called SIRP Security Score (S3). The asset register within SIRP is used in automation playbooks for automated and quick decision-making and reporting.

Assets inventory maps hostnames, IP address, category, classification, and value of each asset.

The containment strategies are decided according to business needs. The escalation matrix and isolation strategies are determined based on the severity of the compromised endpoint. A Server has a high severity and different containment strategy than a workstation.

Act

• The incident response team would first isolate infected endpoints from all network traffic.
• The malicious processes on the identified compromised endpoint(s) are terminated.

• IoCs (malicious domains and IPs) are blocked at perimeter controls and detection engines, such as firewalls, web proxies, EDRs, NDRs, and IPS.
• Reimaging and data recovery from a secured offline backup is performed, followed by an AV scan.
• Finally, custom rules are tuned to detect the same threats in the future.