Ransomware Emulation Done Right

The speakers from eBay open by arguing that ransomware is costly enough to justify testing defenses before an attack. Their program asks three questions: whether employees are susceptible, whether controls and tools actually work, and whether the response is the right one. Education and phishing awareness sit in one track, while purple-team exercises and red-team work cover the controls side. They also describe a sandboxing workflow in which ransomware samples from public repositories run in an isolated cloud virtual machine so the team can see whether endpoint tooling blocks or detects them.

Early testing with a custom payload written in C# and Go was caught by endpoint canary files, which the speakers then bypassed by skipping files with certain name prefixes and by injecting into a trusted process. The exercise produced detection rules for Windows Defender tampering, process injection, and misuse of certutil, and it exposed logging gaps such as missing process command lines, which strengthened the case for a Sysmon rollout. A live simulation followed, limited to directors and above, with executive approval and a short time window. It surfaced problems with help desk handling and the advice to shut down machines instead of isolating them, and the after-action interviews with staff added useful detail.

The talk closes with an intel-driven response to a Microsoft Office URL handler flaw, where detections were built within 48 hours and a workaround was deployed to more than 15,000 hosts after red-team validation. The main takeaways are that red and blue collaboration speeds up detection work, that sandboxing is a low-cost way to check tooling, and that simulations need leadership sign-off and careful planning. The speakers left the question of paying a ransom to legal and executive leadership.