# Could we have seen a weekend ransomware attack coming?

Often, yes, because encryption is the last step of a longer sequence. Before it, attackers usually have to get in, contact their own server, look around, reach the file servers and backups and, in most current attacks, copy data out. Those steps often take days and cross the network: a workstation calling a new outside server at regular intervals, one host scanning internal ranges, new administrator sessions to servers, a large upload at night. Attackers pick weekends and holidays because nobody is watching, not because the earlier steps were invisible. The useful question is whether anything recorded those signs and whether anyone would have seen the alert. NetSenX flags beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included; whether an alert on Friday evening is acted on before Monday depends on your call chain.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/could-we-have-seen-a-weekend-ransomware-attack-coming

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How much time passes between first access and encryption?](https://netsenx.com/en/faq/how-much-time-between-first-access-and-encryption)
- [How can ransomware spread through a USB stick or external drive?](https://netsenx.com/en/faq/how-can-ransomware-spread-through-a-usb-device)
- [What evidence should we keep for the insurer, the police and the regulator?](https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator)
- [How long does NetSenX keep the network evidence of an incident?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-incident-evidence)
- [Should we hire an incident-response firm or handle an incident ourselves?](https://netsenx.com/en/faq/should-we-hire-an-incident-response-firm-or-handle-it-ourselves)