Ransomware and extortion

Learn how to better protect your organization from ransomware and extortion

Frequently asked questions

Concept

• What are the stages in a ransomware attack?
• How do I detect pre-ransom activities?
• How do I back-up and restore post ransomware attack?
• How do I proactively hunt for ransomware?
• Can I download a ransomware incident response playbook?
• What are common types of malware that are used in ransomware campaigns?

Protect against ransomware and extortion

How-To Guide

• Overview
• Prepare your recovery plan
• Limit the scope of damage
• Make it hard to get in

Defense against ransomware

Reference

• In Microsoft 365
• In Azure
• In OneNote
• In Sentinel
• In SharePoint
• Azure Defenses for Ransomware Attack ebook

Threat intelligence for Microsoft 365 Defender subscription holders

Reference

• Threat analytics reports
• Microsoft Defender Threat Intelligence

Blogs

Reference

• Ransomware as a service. Understanding the cybercrime gig economy and how to protect yourself
• Sharing how Microsoft protects against ransomware
• Why Microsoft uses a playbook to guard against ransomware
• Building an anti-ransomware program at Microsoft focused on an Optimal Ransomware Resiliency State
• DEV-0569 finds new ways to deliver Royal ransomware, various payloads
• Stopping C2 communications in human-operated ransomware through network protection
• Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
• DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

Ransomware incident response playbooks

Reference

• Detecting HumOr ransomware with Microsoft 365
• Responding to ransomware attacks
• Microsoft Incident Response approach
• Ransomware Incident Response playbook template