How does a regular user halt actively running ransomware process in remote desktop?

Question

I am considering this scenario:

• An employee is working through Microsoft Remote Desktop in a Windows Server session.
• The employee opens an e-mail attachment which launches a ransomware program.
• The employee quickly realises the mistake while the ransomware process is actively encrypting everything it can reach.

And also:

• The account has no admin permissions in the remote environment (and so cannot shutdown/standby, only logoff/exit)
• The account has access to a lot of files on network shares. For the ransomware to fully encrypt everything would take a long time.
• Contacting IT staff and have them shut down/halt the server would take at least a few minutes.

Is there anything this person could immediately do to halt further encryption of files, and so minimize the need for recovery from backups? For instance, would logging off the Windows session interrupt the ransomware process?

Answer 1

If the user is able to actively log off (rather than just closing the terminal window), all running processes in their session are shut down, stopping the ongoing damage from the infection. I guess that would be the smartest first move for the user to make.

However, the infecting program may abort the session shutdown, preventing the user from actually logging off. Also, if the malware is able to exploit an open security problem on the terminal server, elevating security, it may be able to infect things outside the user session.

Of course, you should make sure that no executable code can get through email (without whitelisting). You might also want to consider restricting users to run approved software only (using Windows's Applocker or Software Restriction Policies).