Case: Ransomware
- Mostly, the encryption and distribution was done before the ransome message appeared.
- Check in which subnets (network segmentation) the host is and to which other systems it has connections.
- Check logs / external loghosts
- Ask employee if there were unusual occurences.
Leave a Reply
You must be logged in to post a comment.