Ransomware Controls That Still Work When Someone Gets In

At 02:13, the first alert is rarely labelled “ransomware.” It is a service account authenticating from a workstation, a burst of remote service creation, or vssadmin.exe deleting shadow copies. By the time encrypted file extensions appear, the attacker may already control Active Directory and know exactly where the backups live.

That is why buying another endpoint product is not a ransomware strategy. The controls that stop an intrusion becoming an estate-wide outage are less glamorous: tight identity boundaries, restricted execution, limited lateral movement, useful detection, and backups that attackers cannot rewrite.

Assume the initial foothold will happen. Your job is to make every step after it noisy, difficult, and contained.

The blast radius starts with identity

Most damaging ransomware incidents become identity incidents before encryption begins. An attacker lands on one endpoint, steals credentials or session material, finds an overprivileged account, and moves toward domain administration, cloud control planes, hypervisors, and backup systems.

Start by finding out who can become an administrator, not merely who has “admin” in a job title. Nested groups, delegated permissions, stale service accounts, and workstation logons by privileged users all matter.

On Active Directory, these basic checks often produce an uncomfortable afternoon:

Get-ADGroupMember 'Domain Admins' -Recursive
Get-ADGroupMember 'Enterprise Admins' -Recursive

Get-ADUser -Filter * -Properties PasswordNeverExpires |
 Where-Object { $_.PasswordNeverExpires -eq $true } |
 Select-Object SamAccountName, Enabled

Get-LocalGroupMember -Group 'Administrators'

The target state is straightforward. Administrators use separate privileged accounts. Those accounts do not browse email or log on to ordinary workstations. Local administrator passwords are unique and rotated through Windows LAPS. Service accounts have the minimum permissions required, preferably using group managed service accounts where Windows supports them.

Require phishing-resistant MFA for privileged and remote access. Push back when somebody proposes an exception for a backup administrator or emergency account. Those are the identities an attacker wants most.

This is where zero trust earns its keep as an operating model rather than a slide deck. A valid password, managed device, or internal IP address should not automatically grant broad access. Each signal narrows a decision. None of them should confer sainthood.

Stop letting every workstation run everything

Ransomware operators routinely use legitimate administration tools because defenders have already allowed them. PowerShell, remote services, WMI, scheduled tasks, PsExec, and RDP all have valid uses. They also make excellent plumbing for an intrusion.

Application control is one of the strongest controls available, and one of the most avoided. Windows Defender Application Control or AppLocker should restrict executable code, scripts, installers, and DLLs according to business need. Start in audit mode, study what would break, fix the policy, then enforce it in stages. An audit policy left running forever is a logging project, not a security boundary.

Microsoft Defender Attack Surface Reduction rules can block common entry and execution paths, including executable content from email and Office applications creating child processes. Test rules against real workflows before enforcement, especially where finance teams depend on old macro-heavy spreadsheets.

Check whether the endpoint controls you paid for are actually active:

Get-MpComputerStatus |
 Select-Object RealTimeProtectionEnabled,
 BehaviorMonitorEnabled,
 IsTamperProtected

Get-MpPreference |
 Select-Object AttackSurfaceReductionRules_Ids,
 AttackSurfaceReductionRules_Actions

Get-SmbServerConfiguration |
 Select-Object EnableSMB1Protocol, EnableSMB2Protocol

EDR agents need tamper protection, health monitoring, and coverage reports. A SOC cannot investigate telemetry that never arrived because an agent stopped checking in three weeks ago.

Make lateral movement hit locked doors

A flat network turns one compromised laptop into a tour of the company. Block workstation-to-workstation SMB and RDP unless a documented workflow requires them. Permit administration through managed jump hosts. Restrict server management ports to administration networks, and keep backup infrastructure on separate network paths with separate identities.

Do not confuse VLANs with segmentation. If broad firewall rules allow every subnet to reach every other subnet, the coloured boxes on the diagram are decorative.

Outbound controls also matter. Servers that do not need direct internet access should not have it. DNS and proxy logs give the detection team valuable context, while egress filtering removes easy command-and-control paths. Attackers can adapt, but adaptation costs time and creates signals.

Test these boundaries from an assumed-compromise position. A useful pentest does not stop after proving that one account can be phished. It asks whether that account can reach management interfaces, dump reusable credentials, modify endpoint tooling, access backup consoles, or push software across the domain. For ransomware readiness, a focused adversary simulation or purple-team exercise is usually more informative than a broad vulnerability scan wearing a pentest badge.

Detect the preparation, not just the encryption

Mass encryption is late-stage behaviour. Detection should focus on the work that precedes it: credential dumping, security-tool tampering, discovery of domain trusts, remote service creation, unusual administrative logons, shadow-copy deletion, and rapid access to many hosts.

For Microsoft Defender XDR, a simple hunting query can surface suspicious recovery sabotage:

DeviceProcessEvents
| where FileName in~ ('vssadmin.exe', 'wmic.exe', 'powershell.exe')
| where ProcessCommandLine has_any (
 'delete shadows',
 'shadowcopy delete',
 'resize shadowstorage'
 )
| project Timestamp, DeviceName, AccountName,
 FileName, ProcessCommandLine

The query is only the beginning. The SOC needs an owner, an escalation path, enough endpoint context to judge the event, and authority to isolate a device quickly. An alert sitting unread until business hours is an audit record.

Tune detections with the people who administer the environment. If backup software legitimately manipulates shadow copies, identify its expected accounts, hosts, parent processes, and schedule. Do not suppress the behaviour everywhere because one tool produces noise.

A backup is not ready until an attacker fails to delete it

Ransomware operators target backups because encryption without recovery pressure is a poor business model. Backup administration must use identities separate from Active Directory administration. Repositories need immutability or offline copies, retention settings protected from casual change, and alerts for deletion, policy modification, and failed jobs.

Then restore something.

A green dashboard proves that a job wrote data. It does not prove that the data is complete, the recovery credentials are available, the encryption keys survived, or the restored system can boot without contacting compromised infrastructure.

Run restore exercises that start with an assumed loss of the primary identity platform and management network. Record the dependencies you discover. Recovery ordering matters: identity, DNS, networking, management services, data platforms, then applications. Trying to recover everything simultaneously usually produces a crowded incident bridge and very little recovery.

Incident response needs decisions made in advance

During an active ransomware incident, the first moves are containment moves. Isolate affected hosts through EDR or network controls. Disable compromised identities, revoke active sessions, and block known infrastructure. Preserve evidence where possible, but do not leave a machine communicating merely to obtain a cleaner forensic image.

Your incident response plan should name who can isolate a business system, shut down remote access, engage legal counsel, contact insurers, and approve recovery into a clean environment. Test those decisions in a tabletop exercise. The technical procedure is often easier than finding somebody willing to authorise it at 02:30.

Cybersecurity readiness comes from combining offensive testing, defensive hardening, threat detection, and rehearsed incident response. Treating those as separate annual activities leaves gaps between teams, and ransomware crews work in the gaps.

If you only do one thing this week

Take one ordinary user workstation and map every route from it to privileged identity, server management, and backup administration. Remove or firewall every path that lacks a current operational reason.

That single exercise exposes flat networks, reused credentials, forgotten admin tools, and backup consoles protected only by location. It also gives the next pentest and SOC tuning session something concrete to verify.

Ransomware readiness is not the promise that nobody gets in. It is the ability to stop one compromised machine from becoming permission to destroy everything.

If this is on your plate, TecLeads does exactly this as part of our Cybersecurity work. If you'd like a second pair of eyes on your setup, book a 30-minute call or explore what we do.