Skip to main content Inicio Creadores yanacuti1121 yana-ai investigating-ransomware-attack-artifacts
investigating-ransomware-attack-artifacts Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
Ir a la instalación Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/yanacuti1121/Yana-AI --skill investigating-ransomware-attack-artifactsEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Más de este repositorio Sovereign-grade safety OS for AI coding agents. 62 hooks, 2,025 skills, L1 memory, circuit breakers, and cross-engine enforcement — blocks rm -rf, force push, pipe-to-shell, and 40+ attack vectors before they reach your repo.
Use when the user wants to generate or keep repository documentation up to date via OpenWiki (langchain-ai/openwiki) — an LLM-driven CLI that writes a wiki for a codebase (or a personal knowledge base from Notion/Gmail/Slack/X/web search) and keeps it fresh via a scheduled CI pull request. Examples: "set up OpenWiki for this repo", "keep the docs updated automatically", "generate an agent wiki".
augmented-reality-from-scratch Use when implementing the core AR pipeline (camera pose estimation, marker tracking, projection overlay) from first principles — not when just using ARKit/ARCore/Unity's AR framework as a black box. Triggers on: 'build augmented reality from scratch', 'marker-based AR tracking', 'camera pose estimation', 'implement fiducial marker detection', 'AR projection matrix math', 'markerless AR tracking'. Covers marker-based vs markerless tracking, pose estimation, and the projection math to overlay 3D content on a camera feed.
Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
Explorador de archivos
4 archivos name investigating-ransomware-attack-artifacts description Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options. domain cybersecurity subdomain digital-forensics tags ["forensics","ransomware","malware-analysis","incident-response","encryption-recovery","evidence-collection"] version 1.0 author mahipal license Apache-2.0 nist_csf ["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"] mitre_attack ["T1005","T1074","T1119","T1070","T1486"] source https://github.com/mukul975/Anthropic-Cybersecurity-Skills source_commit 04450304b12645cb2b974ab96d28c0664758a88d note Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.
Investigating Ransomware Attack Artifacts
When to Use
Immediately after discovering ransomware encryption on systems
When performing forensic analysis to understand the full scope of a ransomware incident
For identifying the ransomware variant and determining if decryption is possible
When tracing the attack chain from initial access to encryption
For documenting evidence to support law enforcement and insurance claims
Prerequisites
Forensic images of affected systems (preserve before remediation)
Memory dumps captured before system shutdown (if available)
Ransom notes and encrypted file samples
Network traffic captures from the attack period
Windows Event Logs, Prefetch files, and registry hives
Access to ransomware identification tools (ID Ransomware, No More Ransom)
Isolated sandbox environment for malware analysis
Workflow
Step 1: Preserve Evidence and Identify the Ransomware Variant
cp /mnt/evidence/Users/*/Desktop/README*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/DECRYPT*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/HOW_TO*.txt /cases/case-2024-001/ransomware/ransom_notes/
find /mnt/evidence/ -name "*.hta" -o -name "*DECRYPT*" -o -name "*RANSOM*" -o -name "*README*" \
2>/dev/null | head -20 > /cases/case-2024-001/ransomware/note_locations.txt
find /mnt/evidence/Users/ -name "*.encrypted" -o -name "*.locked" -o -name "*.crypted" \
-o -name "*.crypt" -o -name "*.enc" | head
mkdir
head
while
read
do
cp
"$f "
done
'PYEOF'
'.lockbit'
'LockBit'
'.blackcat'
'BlackCat/ALPHV'
'.royal'
'Royal'
'.akira'
'Akira'
'.clop'
'Cl0p'
'.conti'
'Conti'
'.ryuk'
'Ryuk'
'.revil'
'REvil/Sodinokibi'
'.maze'
'Maze'
'.phobos'
'Phobos'
'.dharma'
'Dharma/CrySIS'
'.stop'
'STOP/Djvu'
'.hive'
'Hive'
'.blackbasta'
'Black Basta'
'.play'
'Play'
'/cases/case-2024-001/ransomware/samples/'
for
in
'Unknown'
'rb'
read
print
"File: {f}"
print
" Extension: {ext}"
print
" Suspected Variant: {variant}"
print
" SHA-256: {sha256}"
print
'/cases/case-2024-001/ransomware/ransom_notes/'
for
in
'r'
'ignore'
print
"\n=== Ransom Note: {note} ==="
'[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-zA-HJ-NP-Z0-9]{25,39}'
'[a-z2-7]{56}\.onion'
'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'
if
print
" Bitcoin addresses: {btc}"
if
print
" Tor addresses: {tor}"
if
print
" Contact emails: {emails}"
Step 2: Determine the Attack Timeline
find /mnt/evidence/ -name "*.encrypted" -printf '%T+ %p\n' 2>/dev/null | sort | head -5 \
> /cases/case-2024-001/ransomware/encryption_start.txt
find /mnt/evidence/ -name "*.encrypted" -printf '%T+ %p\n' 2>/dev/null | sort -r | head -5 \
> /cases/case-2024-001/ransomware/encryption_end.txt
ls /mnt/evidence/Windows/Prefetch/ | grep -iE "(encrypt|ransom|lock|crypt)" \
> /cases/case-2024-001/ransomware/prefetch_hits.txt
python3 << 'PYEOF'
import json
from evtx import PyEvtxParser
parser = PyEvtxParser("/cases/case-2024-001/evtx/Security.evtx" )
attack_events = []
for record in parser.records_json():
data = json.loads(record['data' ])
event_id = str(data['Event' ]['System' ]['EventID' ])
timestamp = data['Event' ]['System' ]['TimeCreated' ]['#attributes' ]['SystemTime' ]
if event_id in ('4624' , '4625' , '4648' , '4672' , '4697' , '4698' , '4688' , '1102' ):
event_data = data['Event' ].get('EventData' , {})
attack_events.append({
'time' : timestamp,
'event_id' : event_id,
'data' : json.dumps(event_data, default=str)[:200]
})
attack_events.sort(key=lambda x: x['time' ])
print ("=== RANSOMWARE ATTACK TIMELINE ===\n" )
for event in attack_events[-50:]:
print (f" [{event['time']}] EventID {event['event_id']}: {event['data'][:150]}" )
PYEOF
grep -l "vssadmin" /cases/case-2024-001/evtx/*.evtx 2>/dev/null
ls /mnt/evidence/Windows/Prefetch/ | grep -i "vssadmin\|wmic\|bcdedit\|wbadmin"
Step 3: Trace Initial Access and Lateral Movement
python3 << 'PYEOF'
import json
from evtx import PyEvtxParser
from collections import defaultdict
parser = PyEvtxParser("/cases/case-2024-001/evtx/Security.evtx" )
failed_rdp = defaultdict(int)
successful_rdp = []
for record in parser.records_json():
data = json.loads(record['data' ])
event_id = str(data['Event' ]['System' ]['EventID' ])
event_data = data['Event' ].get('EventData' , {})
timestamp = data['Event' ]['System' ]['TimeCreated' ]['#attributes' ]['SystemTime' ]
if event_id == '4625' :
logon_type = str(event_data.get('LogonType' , '' ))
if logon_type == '10' :
source_ip = event_data.get('IpAddress' , 'Unknown' )
failed_rdp[source_ip] += 1
if event_id == '4624' :
logon_type = str(event_data.get('LogonType' , '' ))
if logon_type in ('10' , '3' ):
source_ip = event_data.get('IpAddress' , 'Unknown' )
username = event_data.get('TargetUserName' , 'Unknown' )
successful_rdp.append({'time' : timestamp, 'user' : username, 'ip' : source_ip, 'type' : logon_type})
print ("=== FAILED RDP ATTEMPTS ===" )
for ip, count in sorted(failed_rdp.items(), key=lambda x: x[1], reverse=True)[:10]:
print (f" {ip}: {count} failed attempts" )
print (f"\n=== SUCCESSFUL NETWORK/RDP LOGONS ===" )
for logon in successful_rdp[-20:]:
type_name = 'RDP' if logon['type' ] == '10' else 'Network'
print (f" [{logon['time']}] {logon['user']} from {logon['ip']} ({type_name})" )
PYEOF
find /mnt/evidence/Users/*/Downloads/ -name "*.exe" -o -name "*.dll" -o -name "*.js" \
-o -name "*.vbs" -o -name "*.hta" -o -name "*.ps1" 2>/dev/null \
> /cases/case-2024-001/ransomware/suspicious_downloads.txt
ls /mnt/evidence/Windows/Prefetch/ | grep -i powershell
Step 4: Assess Encryption Scope and Recovery Options
find /mnt/evidence/ -name "*.encrypted" 2>/dev/null | \
awk -F/ '{OFS="/"; NF--; print}' | sort | uniq -c | sort -rn | head -20 \
> /cases/case-2024-001/ransomware/encryption_scope.txt
vssadmin list shadows 2>/dev/null > /cases/case-2024-001/ransomware/vss_status.txt
find /mnt/evidence/ -name "*.bak" -o -name "*.backup" 2>/dev/null | head -20
echo "Check https://www.nomoreransom.org/ for decryption tools" \
> /cases/case-2024-001/ransomware/decryption_options.txt
if [ -f /cases/case-2024-001/memory/memory.raw ]; then
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
--yara-rules 'rule AES_Key { strings: $aes = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 } condition: $aes }' \
> /cases/case-2024-001/ransomware/aes_key_search.txt
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
--yara-rules 'rule RSA_Key { strings: $rsa = "RSA PRIVATE KEY" condition: $rsa }' \
> /cases/case-2024-001/ransomware/rsa_key_search.txt
fi
Step 5: Document Findings and Generate Report
cat << 'REPORT' > /cases/case-2024-001/ransomware/investigation_report.txt
RANSOMWARE INCIDENT INVESTIGATION REPORT
==========================================
Case Number: 2024-001
Date: $(date -u)
Analyst: [Examiner Name]
1. INCIDENT OVERVIEW
- Ransomware Variant: [Identified variant]
- First Encryption: [Timestamp from earliest encrypted file]
- Last Encryption: [Timestamp from latest encrypted file]
- Systems Affected: [Count]
- Data Encrypted: [Volume estimate]
2. INITIAL ACCESS VECTOR
- Method: [RDP brute force / Phishing / Exploit / etc.]
- Entry Point: [System and IP]
- Timestamp: [First unauthorized access]
- Credentials Used: [Account names]
3. ATTACK CHAIN
a. Initial Access: [Details]
b. Execution: [Ransomware binary details]
c. Persistence: [Services, scheduled tasks]
d. Privilege Escalation: [Method used]
e. Lateral Movement: [Systems accessed, methods]
f. Collection/Staging: [Data staging before encryption]
g. Impact: [Encryption execution]
4. INDICATORS OF COMPROMISE
- Ransomware Binary SHA-256: [Hash]
- C2 Servers: [IPs/Domains]
- Bitcoin Wallet: [Address]
- Tor Site: [.onion address]
- Attacker IPs: [Source IPs]
5. RECOVERY ASSESSMENT
- Decryptor Available: [Yes/No]
- Shadow Copies: [Survived/Deleted]
- Backups: [Status and integrity]
- Memory Key Recovery: [Attempted/Results]
6. RECOMMENDATIONS
- [Remediation steps]
- [Prevention measures]
- [Monitoring improvements]
REPORT
Key Concepts Concept Description Ransomware variant identification Determining the specific ransomware family from extensions, notes, and behavior Double extortion Attack combining encryption with data theft and threatened public release Volume Shadow Copies Windows backup mechanism often deleted by ransomware to prevent recovery Encryption scope Assessment of which files, directories, and systems were encrypted Dwell time Period between initial access and ransomware deployment (often days to weeks) Ransom note IoCs Bitcoin addresses, Tor sites, and email addresses in ransom demands Key recovery Attempting to extract encryption keys from memory before shutdown No More Ransom Law enforcement initiative providing free decryption tools for some variants
Tools & Systems Tool Purpose ID Ransomware Online service identifying ransomware variant from samples No More Ransom Free decryption tools from law enforcement partnerships Volatility Memory forensics for encryption key and malware artifact recovery Chainsaw/Hayabusa Windows Event Log analysis for attack timeline reconstruction PECmd Prefetch analysis confirming ransomware executable execution YARA Pattern matching for ransomware variant identification Any.Run/Joe Sandbox Online malware sandboxes for ransomware behavior analysis Capa Mandiant tool identifying malware capabilities from static analysis
Common Scenarios Scenario 1: LockBit Attack via RDP
Trace initial access through RDP brute force in event logs, identify attacker IP and compromised account, follow lateral movement through network logons, find LockBit deployment via PsExec or GPO, document encryption timeline from file timestamps, check for data exfiltration before encryption.
Scenario 2: Phishing-Initiated Ransomware
Trace phishing email through browser history and email artifacts, identify malicious attachment execution in Prefetch, follow Cobalt Strike beacon communication in network logs, trace privilege escalation and domain compromise, document ransomware deployment across the network.
Scenario 3: Supply Chain Ransomware Attack
Identify the compromised software update mechanism, trace the malicious update distribution in application logs, analyze the ransomware payload delivered via the trusted channel, assess which systems received the update, determine if the vendor was notified.
Scenario 4: Recovery from Partial Encryption
Determine which systems and files were encrypted before containment, check for surviving volume shadow copies, verify backup integrity and restoration capability, attempt memory-based key recovery, contact law enforcement for potential decryptor availability.
Output Format Ransomware Investigation Summary:
Variant: LockBit 3.0
First Seen: 2024-01-18 02:00:00 UTC
Encryption Duration: 4 hours 23 minutes
Systems Encrypted: 45 out of 200 (containment stopped spread)
Attack Timeline:
2024-01-10 14:32 - RDP brute force from 203.0.113.45 (1,234 attempts)
2024-01-10 15:00 - Successful RDP login as admin_backup
2024-01-12 02:00 - Mimikatz executed (credential dump)
2024-01-12 02:30 - Domain Admin credentials obtained
2024-01-15 03:00 - Data exfiltration (45 GB to 185.x.x.x)
2024-01-18 02:00 - LockBit deployed via PsExec to 45 systems
2024-01-18 06:23 - Encryption completed on affected systems
Recovery Options:
Decryptor: Not available (LockBit 3.0)
Shadow Copies: Deleted on all systems
Backups: Last clean backup 2024-01-09 (9 days of data loss)
Memory Keys: Not recovered (systems rebooted)
IOCs:
Ransomware Hash: a1b2c3d4e5f6...
C2 IP: 185.x.x.x
Bitcoin: bc1q...
Tor: http://lockbit...onion
