Incident Response
Inhibit System Recovery: Ransomware Detection Guide
Inhibit system recovery detection covers shadow-copy deletion, backup-catalog changes, recovery disablement, cloud snapshot removal, and containment.
Category
Incident Response
Practical guidance for incident response decisions and defensible security work.
8 resources
Resources in this category
Browse all resources
Incident Response
Immutable Backups for Ransomware Recovery
Immutable backup ransomware recovery requires isolated administration, retention locks, independent identities, clean restore points, and tested dependencies.
Incident Response
Cloud Audit Log Tampering: Detection and Recovery
Cloud audit log tampering detection covers configuration changes, delivery gaps, integrity validation, immutable storage, independent evidence, and recovery.
Incident Response
Malware Analysis: Static, Dynamic, and Code Analysis
Learn how malware analysis works, from safe intake and static triage to dynamic behavior, code analysis, evidence reporting, detection, and response.
Incident Response
First Response to an Account, Device, or Data Compromise
Take calm, prioritized action after suspicious access, malware, device loss, or data exposure while preserving trustworthy recovery options.
Incident Response
Ransomware Containment, Recovery, and Extortion Decisions
Coordinate isolation, evidence, identity containment, business continuity, restoration, and extortion decisions during a ransomware incident.
Incident Response
Evidence Preservation for Security Investigations
Preserve security evidence with enough context, integrity, and proportionality to support reliable investigation and action.
Incident Response
The Incident Response Lifecycle
Follow an evidence-led incident response lifecycle from preparation and triage through recovery and durable improvement.