Demo: Ransomware incident response

Tuesday 08:47. You are a SOC analyst at Nexa Logistics, a transport company with 400 employees. The EDR fires a critical alert on the CFO's laptop: a powershell.exe child process of OUTLOOK.EXE runs a Base64-encoded command and, in the last 60 seconds, 312 files in the Documents folder have been renamed with the .lockx extension. The machine is still connected to the corporate VPN and the Finance share on the NAS is answering SMB requests from that host.