Understanding attackers’ TTPs is key to stopping attacks before ransomware is deployed.