Trace Id is missing

Internet Explorer was retired on June 15, 2022

IE 11 is no longer accessible. You can reload Internet Explorer sites with IE mode in Microsoft Edge.
Internet Explorer is changing to Edge.

Windows Defender ATP - ransomware playbook

This playbook discusses how enterprises can leverage Windows Defender ATP to detect, investigate, and mitigate ransomware threats in their networks.

Important! Selecting a language below will dynamically change the complete page content to that language.

Download
  • Version:

    1.0

    Date Published:

    4/17/2017

    File Name:

    Windows Defender ATP - Ransomware response playbook.pdf

    File Size:

    1.7 MB

    This document provides an overview of how enterprise customers can leverage Windows Defender Advanced Threat Protection (Windows Defender ATP) to detect, investigate, and mitigate ransomware threats in their networks. It walks through different stages of incident response and shows how Windows Defender ATP can serve as an invaluable tool during each of these stages. This playbook refers to a real-world infection involving Cerber ransomware, one of the most active ransomware families. It shows how Windows Defender ATP can help catch a specific Cerber variant and, at the same time, catch ransomware behavior generically.
  • Supported Operating Systems

    Windows 10

    Use a web browser or a PDF reader to view this document.
  • No special instructions required.
Follow Microsoft