investigating-ransomware-attack-artifacts

name	investigating-ransomware-attack-artifacts
description	Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options. Use when working with investigating ransomware attack artifacts.
domain	cybersecurity
tags	["forensics","ransomware","malware-analysis","incident-response","encryption-recovery","evidence-collection"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Investigating Ransomware Attack Artifacts

Overview

Cybersecurity skill for investigating ransomware attack artifacts. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "investigating ransomware attack artifacts"

• "Identify, collect, and analyze ransomware attack artifacts to determine the vari"

• Immediately after discovering ransomware encryption on systems

• When performing forensic analysis to understand the full scope of a ransomware incident

• For identifying the ransomware variant and determining if decryption is possible

• When tracing the attack chain from initial access to encryption

• For documenting evidence to support law enforcement and insurance claims

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic images of affected systems (preserve before remediation)
• Memory dumps captured before system shutdown (if available)
• Ransom notes and encrypted file samples
• Network traffic captures from the attack period
• Windows Event Logs, Prefetch files, and registry hives
• Access to ransomware identification tools (ID Ransomware, No More Ransom)
• Isolated sandbox environment for malware analysis

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}