Windows Defender Advanced Threat Protection - Ransomware response playbook

This document provides an overview of how enterprise customers can leverage Windows Defender Advanced Threat Protection (Windows Defender ATP) to detect, investigate, and mitigate ransomware threats in their networks. It walks through different stages of incident response and shows how Windows Defender ATP can serve as an invaluable tool during each of these stages. This playbook refers to a real-world infection involving Cerber ransomware, one of the most active ransomware families. It shows how Windows Defender ATP can help catch a specific Cerber variant and, at the same time, catch ransomware behavior generically.

Windows 10

Use a web browser or a PDF reader to view this document.