BLOG

By David Chernitzky, Co-Founder and CEO, Armour Cybersecurity  |  Serving organizations across Canada, the US, and beyond  |  Last updated August 19, 2026

Quick answer: Endpoint security ransomware protection for business starts from one fact: ransomware does not appear as a single event. It moves through an endpoint in stages over hours or days before encryption begins: initial access via a phishing payload or stolen credential, execution of a loader or dropper, privilege escalation to gain administrative rights, lateral movement to identify and access shared drives and backup systems, and finally the deployment and execution of the encryption payload. EDR watches the endpoint continuously and generates detections at each stage of this chain. An organization with a properly deployed and operated EDR has multiple opportunities to detect and contain the attack before the encryption event. An organization with only antivirus has one: if the ransomware binary matches a known signature, it is blocked. If it does not, the attack completes.

Key Takeaways

• Ransomware is a multi-stage attack, not a single event. The stages before encryption, including initial access, execution, privilege escalation, lateral movement, and reconnaissance of backup and recovery systems, take time and generate behaviors that EDR is designed to detect. Early detection at any stage of the chain limits the blast radius of the attack.
• Modern ransomware groups use fileless techniques specifically to evade antivirus detection. The initial payload may be a macro in an Office document that downloads a PowerShell script that executes in memory. No malicious binary is written to disk for the antivirus to scan. EDR detects the suspicious PowerShell execution, the memory injection, and the unusual child process spawning that characterize this attack pattern regardless of whether a matching signature exists.
• The most consequential EDR detection in a ransomware attack is not catching the encryption payload; it is catching the attacker during the pre-encryption stages when containment is still possible without data loss. An EDR alert on credential theft or lateral movement, properly investigated and responded to, stops the attack before any files are encrypted. An EDR alert on the encryption payload itself is valuable but arrives after the damage has begun.
• Endpoint isolation is the response action that limits ransomware blast radius. When an EDR confirms that an endpoint is compromised, the immediate response is isolation: severing the endpoint’s network connectivity while preserving the telemetry and forensic evidence needed to investigate the scope of the intrusion. A properly deployed EDR allows the administrator to isolate a compromised endpoint in seconds from the management console, preventing the ransomware from reaching shared network drives and other endpoints through the compromised system.
• Business continuity after a ransomware event is materially better for organizations with EDR. The forensic telemetry captured by EDR during the attack chain provides the evidence needed to understand the full scope of the intrusion, identify all compromised endpoints, determine what data was accessed or exfiltrated before encryption, and support the regulatory notification assessment. Without this telemetry, the scope investigation is guesswork and the notification decision is made under uncertainty.

The Ransomware Attack Chain: Stage by Stage

The reason ransomware endpoint protection works at all is that the attack is a sequence, not a moment, and each step in the sequence is an opportunity for endpoint threat detection to fire. If you want the underlying contrast between behavioral detection and the signature scanning that misses these stages, what EDR is and why antivirus is no longer enough lays it out; here we walk the chain itself.

Stage 1: Initial access

Most ransomware intrusions begin with a phishing email. The email delivers a malicious attachment, typically an Office document with a macro, a PDF with an embedded link, or a compressed archive containing an executable. When the victim opens the attachment and enables the macro or executes the file, the initial payload runs. This payload is typically not the ransomware itself; it is a loader or dropper whose job is to download and execute the next stage of the attack from attacker-controlled infrastructure.

At this stage, EDR is watching the behavior of the email client and the document application. A Word document that spawns a PowerShell child process is suspicious because it is not normal behavior for a document application. A PDF reader that initiates a network connection to an external IP address and downloads an executable is suspicious. The EDR’s detection logic for initial access techniques, mapped to the Initial Access and Execution tactics in the MITRE ATT&CK framework, fires at this stage. In an organization with a well-tuned EDR and trained administrators who investigate high-priority alerts promptly, this is the first opportunity to stop the attack before it progresses further.

Stage 2: Execution and persistence

After the initial payload executes, the attacker establishes a persistent foothold on the endpoint. Persistence mechanisms are techniques that allow the attacker’s code to survive a system reboot and maintain access to the endpoint even if the initial payload is removed. Common persistence mechanisms include scheduled tasks, registry run keys, WMI subscriptions, and service installations. These are all actions that EDR monitors at the kernel level.

The attacker also typically deploys a remote access tool (RAT) or a command-and-control (C2) implant that establishes an encrypted communication channel to attacker infrastructure. This channel is what the attacker uses to issue commands, receive stolen data, and ultimately deploy the ransomware payload. EDR network monitoring detects the beaconing behavior of C2 implants, which typically communicate with attacker infrastructure on a regular schedule. An implant that sends a heartbeat to an external server every sixty seconds generates a distinctive periodic network connection pattern that EDR network behavior analysis detects.

Stage 3: Privilege escalation and credential theft

Once the attacker has a persistent foothold on the endpoint, the next goal is to escalate from the privileges of the compromised user account to administrative or system-level privileges. With administrative rights, the attacker can access any file on the system, disable security software, and move to other systems using the administrative credentials that are cached or accessible from a privileged context.

Credential theft at this stage is where the attack becomes most consequential for the broader organization. Tools like Mimikatz extract credential hashes from Windows memory (the LSASS process), which can be used to authenticate to other systems without knowing the actual password. EDR detects LSASS memory access from processes that are not legitimate security tools or operating system components. This detection is one of the highest-fidelity signals in an EDR’s detection ruleset because LSASS access from a non-system process is rarely legitimate and consistently indicates credential theft activity. This is also where identity and privilege access management earns its keep: least-privilege accounts and tightly controlled admin rights shrink what a stolen credential can reach, so an EDR detection at this stage has a smaller blast radius to contain in the first place.

Stage 4: Lateral movement and reconnaissance

With valid administrative credentials, the attacker moves laterally across the network from the initially compromised endpoint to other endpoints, servers, and domain controllers. Lateral movement techniques include Pass-the-Hash (using stolen credential hashes to authenticate without knowing the password), remote service execution through tools like PsExec or WMI, and exploitation of remote services running on other endpoints. EDR detects the behavioral signatures of these techniques on both the source endpoint (the one initiating the movement) and the destination endpoint (the one being accessed).

During this stage, the attacker also conducts reconnaissance to understand the network environment: identifying file servers and shared drives that hold the data the ransomware will encrypt, locating and either disabling or deleting backup systems and shadow copies, and mapping the domain structure to understand the full scope of the environment they will encrypt. Backup deletion and shadow copy deletion are particularly high-fidelity EDR detections because these are actions that have no legitimate administrative purpose and are a consistent pre-ransomware indicator across virtually every modern ransomware group.

Stage 5: Encryption deployment

The final stage is the deployment and execution of the encryption payload. By this stage, the attacker has mapped the environment, stolen credentials, spread to high-value targets, and positioned the encryption payload to execute simultaneously across as many systems as possible. The encryption event itself, when it begins, generates extremely distinctive endpoint behavior: rapid file enumeration and modification across the file system, file extension changes, and in many cases the creation of ransom note files in each encrypted directory.

A properly deployed EDR with ransomware-specific detection rules fires at the onset of encryption behavior. The response action at this stage is endpoint isolation, immediately severing the endpoint’s network connectivity to prevent the encryption process from spreading to mapped network drives and other endpoints. Isolation preserves the forensic evidence on the endpoint while containing the spread. The earlier in the attack chain the detection occurs, however, the better the outcome: a detection at Stage 3 that stops the attack before lateral movement has occurred means one compromised endpoint rather than fifty.

What EDR Changes About the Outcome

The difference between a ransomware event that encrypts a single endpoint and one that encrypts the entire organization’s file servers and backup systems is almost entirely determined by the detection and response speed at the early stages of the attack chain. Organizations with well-tuned EDR programs, trained administrators who investigate high-priority alerts promptly, and documented response procedures for credential theft and lateral movement detections stop most ransomware attacks before the encryption payload executes. Those that do not have this capability experience the full blast radius of the attack: encrypted servers, inaccessible backups, regulatory notification obligations, and recovery timelines measured in weeks.

The EDR telemetry captured during a ransomware event also materially improves the forensic investigation and the regulatory response. The process tree shows exactly what executed and in what order. The network telemetry shows every system the attacker connected to. The file activity log shows what data was accessed and potentially exfiltrated before encryption. This evidence is what allows the organization to determine whether the attack involved data exfiltration, which endpoints are confirmed compromised versus potentially exposed, and what the attacker accomplished during their dwell time, all of which feeds directly into the endpoint protection evidence auditors and regulators expect when a breach triggers a notification assessment. Without EDR telemetry, the forensic investigation relies on whatever logs the organization happened to collect, which rarely provides the same fidelity or completeness.

Armour Cybersecurity deploys EDR with ransomware-specific detection rules and threat hunting playbooks built around the specific techniques that active ransomware groups use. The ninety-day hypercare period includes alert response coaching for the high-priority detections, including the credential theft and lateral movement alerts that provide the earliest and most actionable warning of an attack in progress.

Frequently Asked Questions

If we have good backups, do we still need EDR?

Yes, for several reasons. First, modern ransomware groups exfiltrate data before encrypting it. They steal your data, then encrypt it. The ransom demand is not just for the decryption key; it is also to prevent the public release of the stolen data. Backups address the encryption problem but not the exfiltration problem. Second, recovery from ransomware without EDR forensic telemetry means recovering to an unknown point in time without certainty about when the compromise occurred, which systems were affected, or what credentials are still valid. Organizations that restore from backups without a forensic investigation frequently experience a second ransomware event within months because the attacker’s persistence mechanisms were not removed from the environment before restoration. EDR provides the telemetry that makes the forensic investigation possible and the detection capability that surfaces the persistence mechanisms that need to be removed before recovery is complete.

What ransomware groups are most active and what techniques do they use?

The ransomware landscape changes continuously as groups emerge, rebrand after law enforcement actions, and adopt new techniques. The most consequential groups in 2025 and 2026 have increasingly shifted to double-extortion models (encryption plus data exfiltration), Ransomware-as-a-Service (RaaS) affiliate programs where the malware developers license their platform to independent affiliates who conduct the attacks, and initial access brokers who specialize in selling compromised credentials and network access to ransomware affiliates. Common initial access techniques include phishing, exploitation of public-facing applications, and use of stolen credentials purchased from initial access brokers or harvested from prior breaches. Threat hunting playbooks tailored to the specific techniques used by groups active in the organization’s industry sector are one of the deliverables Armour Cybersecurity develops during the EDR engagement.

Can EDR stop an attack that comes through a vendor or third-party connection?

EDR monitors the endpoint regardless of how an attacker arrives. Whether the initial access is through a phishing email, a compromised vendor VPN credential, or a supply chain compromise that delivers malicious code through a software update, the attacker must eventually execute code or take actions on an endpoint. Those actions are what EDR detects. The detection ruleset covers the behavioral techniques attackers use after they have access, which are consistent across different initial access vectors. A vendor-originated attack that uses the same credential theft and lateral movement techniques as a phishing-originated attack will trigger the same EDR detections. The initial access vector determines how the attacker got in; the behavioral detection determines whether the organization can identify and contain the attack before it completes.

How quickly should we respond when EDR fires a high-priority alert?

For alerts indicating active credential theft, lateral movement, or pre-ransomware behaviors such as backup deletion and shadow copy removal, the target response time should be measured in minutes, not hours. These are the indicators that an attack is in progress and that the window to contain it before the encryption payload deploys is closing. A documented incident response procedure, and a defined path into full breach response when the alert confirms a live intrusion, is what allows a high-priority alert to be acted on in minutes rather than the time it takes to figure out the response process under pressure. The procedure specifies who receives the escalation, what the immediate containment actions are including whether to isolate the endpoint, and who is authorized to take those actions. The administrator training and response procedure documentation delivered as part of an EDR engagement are designed specifically to compress this response time for the alert types that matter most.

The Bottom Line

Ransomware gives you more warning than most organizations realize, but only if something is watching the endpoint for it. Between the phishing click and the encryption event sit hours or days of loud, detectable activity: a document spawning PowerShell, an implant beaconing out, LSASS memory being read, shadow copies being deleted, credentials being replayed across the network. Antivirus sees almost none of it and gets one chance at the final payload. EDR sees all of it and gets five chances to stop the attack before a single file is encrypted, and the earlier the catch, the smaller the damage, one endpoint instead of fifty. The catch only happens, though, if the alerts are tuned, the administrators are trained to act in minutes, and the response is documented before the pressure hits. A structured EDR program builds exactly that: ransomware-specific detection, endpoint isolation on demand, and the forensic telemetry that turns recovery from guesswork into a known-scope operation.