Could we have seen a weekend ransomware attack coming?

Often, yes, because encryption is the last step of a longer sequence. Before it, attackers usually have to get in, contact their own server, look around, reach the file servers and backups and, in most current attacks, copy data out. Those steps often take days and cross the network: a workstation calling a new outside server at regular intervals, one host scanning internal ranges, new administrator sessions to servers, a large upload at night. Attackers pick weekends and holidays because nobody is watching, not because the earlier steps were invisible. The useful question is whether anything recorded those signs and whether anyone would have seen the alert. NetSenX flags beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included; whether an alert on Friday evening is acted on before Monday depends on your call chain.

← All 60 questions on Incident responseAll topics