Stopping Ransomware Before Encryption – Threat Hunting Lessons from a Real-World Identity Attack

Every ransomware investigation begins long before encryption. Success depends on recognizing the seemingly ordinary activity attackers use to establish access, move through an environment, and position themselves before launching the final stage of an attack.  Using a real-world incident involving Fusion Computing, presenters reconstruct an identity-driven intrusion that was identified and contained before ransomware could be deployed. Attendees will follow the investigation from an initial social engineering phone call through PowerShell execution, command-and-control activity, and living-off-the-land techniques that initially blended with legitimate administrative behavior. Bryson demonstrate how endpoint telemetry, identity signals, and forensic artifacts were used to reconstruct the attack timeline, validate attacker activity, identify the evidence that mattered most, and prioritize containment decisions before encryption could occur. The session also examines how the observed techniques map to the MITRE ATT&CK framework, highlighting practical opportunities to improve visibility into identity-based attacks and strengthen threat hunting workflows. Participants will leave with practical hunting techniques for detecting identity-driven intrusions, investigative approaches for validating attacker activity, and recommendations for strengthening ransomware detection before encryption begins.