MITRE ATT&CK and ransomware: where containment fits.

An affiliate operation looks much the same across families. Access comes through a valid account on an exposed RDP or VPN service (T1078 Valid Accounts, often after T1110 Brute Force), through an exploited edge device (T1190 Exploit Public-Facing Application) or through phishing (T1566). Inside, the operator enumerates shares (T1135 Network Share Discovery), moves over SMB admin shares (T1021.002 Remote Services: SMB/Windows Admin Shares) and disables or tampers with the endpoint agent (T1562.001 Disable or Modify Tools), now routinely with a vulnerable signed driver. The operator exfiltrates data before encrypting anything (T1048 Exfiltration Over Alternative Protocol, T1567 Exfiltration Over Web Service), because most groups extort twice, on the stolen data and on the encrypted data. The operator then deletes shadow copies and backups (T1490 Inhibit System Recovery), stops database and backup services so their files can be locked (T1489 Service Stop), and encrypts (T1486 Data Encrypted for Impact), or in some intrusions wipes instead (T1485 Data Destruction).

Some of the earlier-stage detections already trigger automated response, for example a known-bad hash or a lockout threshold. At the file layer the analytics observe the encryption directly: a thousand files renamed to an extension the environment has never used, a ransom note written into every folder within a minute, or file headers that no longer match their extension. Because the signal is the encryption in progress, the response (disable the account, end its sessions, isolate the host) can be pre-authorised, since a false positive disables an account and isolates a host, both of which an administrator can release.

Helm is agentless on the file server. It reads SMB file activity on monitored shares and change events from Microsoft 365, evaluates each event against 38 analytics, and tags each finding with the ATT&CK tactic and technique it maps to.

• T1486 Data Encrypted for Impact. Rename rate and rename spikes per interval, files created or renamed to extensions the environment has never used, known ransomware extensions, encrypted-file headers, ransom notes written to several directories within a minute, canary files touched, Office, PDF and database files that no longer parse. Twenty-one of the 38 analytics map here.

• T1485 Data Destruction. Deletion rate per interval, canary files deleted.

• T1490 Inhibit System Recovery. Modification, rename or deletion of backup and virtual-disk files (.bak, .vhd, .vhdx, .vmdk, .mdf, .ldf).

• T1036.008 Masquerade File Type, T1036.007 Double File Extension. File content that does not match the extension, extensionless files with an executable header, a second extension appended to a trusted one.

• T1078 Valid Accounts, T1110 Brute Force. Logins and failed logins to RDP-protected servers, through the MFA enforcement component (SIP).

• T1037.003 Network Logon Script, T1135 Network Share Discovery. Changes to NETLOGON and SYSVOL on domain controllers.

• T1053.005 Scheduled Task. Task Scheduler changes on the Helm server nodes themselves.

In ATT&CK v18 Detection Strategy terms, Helm's telemetry is File Creation, File Modification, File Deletion and Network Share Access, with Logon Session Creation from SIP. The T1486 and T1490 detection strategies list those data components. Helm collects them at the share, so the detections still run after T1562.001 has disabled the endpoint agent.

Not observed.

Helm does not detect processes (there is no agent on the endpoint or the file server), lateral movement over SMB as such (T1021.002), endpoint-agent tampering (T1562.001) or exfiltration (TA0010); the EDR, proxy and DLP controls cover those. Files encrypted between the first malicious write and the cut are restored from backup or file versioning.

The response is a fixed sequence that runs without a human in the loop once it is armed. Helm disables the account doing the writing, ends its sessions, removes its access to the affected shares and, through the EDR or NAC the organisation already runs, isolates the host it is writing from. The actions run in parallel, so time to contain equals the slowest single action. Before automated response is armed, the analytics run through a learning period that baselines rename and change rates per share and builds the list of extensions the environment uses, so a backup job or a migration script that looks like encryption produces an alert and no containment during that period.

In one incident, INC-2026-0312-001, the sequence completed 8.9 seconds after the first detection finding, with ten actions in parallel and 14 files encrypted before the writing stopped. Inside the engine, typical time from detection to the session being cut is one to two seconds.

Helm exports each finding as an OCSF Detection Finding (class 2004, OCSF 1.8.0) with the ATT&CK tactic and technique, the account, the source host, the share path, the files touched, and the containment actions taken with their timestamps. In a SIEM or XDR coverage map Helm appears as a T1486 and T1490 source at the file layer, alongside the process-level sources from the EDR. The containment actions and their timestamps are in the same event, so the analyst sees what ran before opening a ticket.

Helm does not prevent intrusion and does not replace the EDR. It does not detect processes, lateral movement or exfiltration. Files encrypted before the cut are restored from backup. Helm acts only through connected systems: it disables an account where a directory is connected and isolates a host where an EDR or NAC is connected. A false positive disables an account and isolates a host; the learning period reduces false positives, and an administrator releases a contained account or host in the console. Within those limits Helm contains ransomware at Impact on the connected shares and tenant, at the speed of the attack.