"Lab 18 — Ransomware Incident Investigation"

Mission Information

Item	Details
Lab	18
Lab Name	Ransomware Incident Investigation
Track	CompTIA CySA+
Difficulty	Intermediate–Advanced
Estimated Time	150–180 minutes
Primary Role	SOC Analyst / Incident Response Analyst
Environment	CySA+ Incident Response Lab
Primary Systems	SIEM + Windows Endpoint + Linux Server + Analyst Workstation
Primary Data Sources	Windows Logs, PowerShell Logs, Endpoint Telemetry, Zeek, Suricata, DNS, Authentication Logs
Skills	Ransomware Investigation, Incident Scoping, Timeline Analysis, IOC Analysis, Lateral Movement Detection, Containment Planning

Lab Safety: This mission uses simulated ransomware artifacts and telemetry. Do not download, execute, or deploy real ransomware.

Mission Scenario

You are working as a Cybersecurity Analyst at GHC Enterprise.

At approximately:

09:42

the SOC receives several high-severity alerts from:

CYSA-WIN01
10.10.10.20

Initial telemetry shows:

Suspicious Authentication
        ↓
PowerShell Execution
        ↓
Unknown Process
        ↓
Rapid File Modifications
        ↓
Outbound Network Activity

Minutes later, a user reports:

“My documents will not open, several filenames have changed, and there is a strange text file on my desktop.”

The security team suspects ransomware.

However, before declaring a ransomware incident, you must determine:

• what happened

• how access was obtained

• which process initiated the activity

• whether encryption actually occurred

• whether credentials were compromised

• whether lateral movement occurred

• how many systems are affected

• whether data exfiltration may have occurred

• what evidence must be preserved

• what must be contained immediately

Mission Objective: Investigate a simulated ransomware incident from initial access through impact, determine its scope, preserve relevant evidence, identify indicators of compromise, and recommend prioritized containment actions.

Mission Objectives

By completing this lab, you will be able to:

• identify ransomware indicators

• validate ransomware-related alerts

• determine potential initial access

• investigate suspicious authentication

• analyze process execution

• investigate PowerShell activity

• identify suspicious parent-child process relationships

• detect mass file modifications

• identify ransomware-note artifacts

• investigate persistence

• identify credential-access indicators

• detect lateral-movement indicators

• investigate suspicious network activity

• identify affected systems and users

• build a ransomware incident timeline

• collect and enrich ransomware IOCs

• assess potential data exfiltration

• determine incident severity

• recommend emergency containment

• document an incident-response assessment

1. Understand the Ransomware Attack Lifecycle

A ransomware incident is rarely limited to:

Malware
  ↓
Encrypt Files

Modern incidents may follow:

Initial Access
      ↓
Execution
      ↓
Persistence
      ↓
Privilege Escalation
      ↓
Credential Access
      ↓
Discovery
      ↓
Lateral Movement
      ↓
Data Collection
      ↓
Possible Exfiltration
      ↓
Encryption / Impact

Your investigation must therefore look before the encryption event.

2. Understand Double Extortion

Some ransomware operations may attempt:

Data Theft
   +
Encryption

The attacker may threaten to:

Publish Data

even if systems are later restored from backups.

Therefore, an investigation must consider both:

Availability Impact

and:

Confidentiality Impact

3. Start the Lab Environment

Start:

CYSA-ANALYST
10.10.10.10

CYSA-WIN01
10.10.10.20

CYSA-LINUX01
10.10.10.30

CYSA-SIEM
10.10.10.40

Verify that the SIEM contains:

Windows Security Logs
PowerShell Logs
Process Events
DNS
Zeek
Suricata
Authentication Events

4. Create the Investigation Workspace

On CYSA-ANALYST:

mkdir -p ~/CySA-Lab/Investigations/LAB18/{Evidence,Logs,Network,IOCs,Timeline,Screenshots,Reports}

Create investigation notes:

touch ~/CySA-Lab/Investigations/LAB18/investigation-notes.md

Use:

Incident ID:
LAB18-RANSOM-001

5. Record the Initial Alert

Document:

Incident:
LAB18-RANSOM-001

Initial Host:
CYSA-WIN01

IP:
10.10.10.20

Detection:
Potential Ransomware Activity

Initial Alert Time:
09:42

Initial Severity:
Critical

Capture the original SIEM alert before beginning deeper analysis.

6. Define the Initial Investigation Window

If encryption-like activity occurred at:

09:42

begin with a window such as:

08:42–10:00

Then expand backward as evidence requires.

Why?

Because:

Encryption Event
      ≠
Initial Compromise

The attacker may have gained access significantly earlier.

7. Validate the Ransomware Alert

Determine what triggered the alert.

Look for:

Rapid File Changes
Unusual File Extensions
Suspicious Processes
Ransom Note Creation
Backup Deletion Attempts
Shadow Copy Activity
Security Tool Interference

Do not classify the incident solely from the alert name.

Validate the underlying evidence.

8. Identify File-Encryption Indicators

Look for unusual changes such as:

report.docx
      ↓
report.docx.locked

or multiple files being renamed rapidly.

Review:

Filename
Original Extension
New Extension
Modification Time
Process Responsible
User Context

9. Detect Mass File Modification

Look for:

One Process
     ↓
Hundreds of Files
     ↓
Short Time Window

This pattern is significantly different from normal user activity.

Document:

Process
Files Modified
Directories
Time Range
User

10. Identify the Ransom Note

Search for newly created files such as:

README.txt
RECOVER_FILES.txt
RESTORE_FILES.txt
HOW_TO_RECOVER.txt

Use only the simulated artifact provided in your lab.

Record:

Filename
Path
Creation Time
Creating Process
SHA-256

Do not interact with any external contact information contained in a ransom note.

11. Preserve the Ransom Note

Copy the simulated artifact to:

LAB18/Evidence/

Calculate:

sha256sum <ransom-note-file>

Record the hash in your evidence inventory.

12. Identify the Suspected Ransomware Process

Search process telemetry around the encryption time.

Look for:

Unknown Executable
Unexpected Script
PowerShell
cmd.exe
wscript.exe
cscript.exe
rundll32.exe

Record:

Process Name
PID
Parent PID
Parent Process
Command Line
User
Timestamp

13. Analyze Process Lineage

Build:

Parent
  ↓
Child
  ↓
Grandchild

For example:

Email Client
    ↓
Office Application
    ↓
PowerShell
    ↓
Unknown Executable

or:

Browser
   ↓
Downloaded File
   ↓
PowerShell

Process lineage can help identify the initial execution vector.

14. Investigate Windows Process Events

Search:

Event ID 4688

for the affected host.

Focus on the period before encryption.

Identify:

Suspicious Commands
Unusual Executables
Temporary Paths
Encoded Commands
Script Interpreters
Administrative Utilities

15. Investigate PowerShell Activity

Search PowerShell Operational telemetry.

Where available, review:

Event ID 4104

Look for suspicious activity such as:

Encoded or Obfuscated Commands
Unexpected Downloads
System Discovery
Credential-Related Commands
Security Configuration Changes

The presence of PowerShell alone is not malicious.

Context matters.

16. Search for Suspicious Execution Locations

Review execution from locations such as:

Downloads
Temp
AppData
Public
User Profile

Unexpected binaries executing from user-writable locations deserve additional investigation.

17. Determine Potential Initial Access

Now move backward in the timeline.

Investigate whether activity originated from:

Phishing
Stolen Credentials
Exposed Remote Service
Malicious Download
Compromised Account
Existing Malware

Use evidence from previous labs where appropriate.

18. Investigate Phishing Evidence

Search for:

Suspicious Email
Attachment
URL
Sender
Domain

Determine whether:

Email Delivered
      ↓
User Interaction
      ↓
Process Execution

can be supported by evidence.

19. Investigate Authentication Activity

Search:

4624
4625
4672

Review:

Failed Logins
Successful Logins
Source IP
Username
Logon Type
Privilege
Timestamp

Look for suspicious sequences such as:

Multiple Failures
      ↓
Successful Authentication
      ↓
Privileged Activity

20. Identify Potential Credential Abuse

Ask:

Was the account expected to authenticate?

Was the source expected?

Was privileged access obtained?

Was the account used on additional systems?

Did authentication occur at unusual times?

Record all affected accounts.

21. Investigate Credential Access Indicators

Look for telemetry suggesting attempts to access:

Credentials
Authentication Tokens
Browser Credentials
Saved Passwords
Credential Stores

Do not perform credential-dumping activity yourself.

This lab focuses on detection and investigation.

22. Identify Privileged Account Usage

Search for privileged authentication activity.

Review:

4672

where relevant.

Determine whether:

Administrative Privileges

were obtained before encryption.

Privileged access can dramatically increase ransomware impact.

23. Investigate Persistence

Look for suspicious changes involving:

Scheduled Tasks
Services
Startup Locations
Registry Run Keys
New Accounts

The attacker may establish persistence before deploying ransomware.

24. Investigate Scheduled Tasks

Review:

Get-ScheduledTask

Look for:

Unexpected Task Names
Unusual Executables
User-Writable Paths
Suspicious Trigger Times

Record suspicious findings.

25. Investigate Services

Review:

Get-Service

Look for unexpected recently created or modified services based on your lab telemetry.

Do not disable anything until evidence has been preserved and containment is authorized.

26. Investigate New Accounts

Review security telemetry for account creation.

Look for:

Event ID 4720

Determine:

Account
Creator
Timestamp
Privileges

An unexpected administrative account can indicate persistence.

27. Investigate Security Control Interference

Ransomware operators may attempt to weaken defenses.

Look for evidence involving:

Security Tool Stopping
Logging Changes
Firewall Changes
Backup Service Interference
Endpoint Protection Changes

Do not reproduce destructive commands.

Your task is to identify the telemetry.

28. Investigate Backup and Recovery Interference

Look for evidence suggesting attempts to affect:

Shadow Copies
Backup Services
Recovery Features
Restore Points

Document:

Process
Command Context
User
Timestamp
Outcome

These activities can strongly support a ransomware assessment.

29. Investigate System Discovery

Before ransomware deployment, attackers may identify:

Hostname
Users
Domain
Network Configuration
Shares
Processes
Services

Look for unusual discovery commands in process telemetry.

30. Investigate Network Share Discovery

Look for activity related to:

SMB
Network Shares
Mapped Drives
Administrative Shares

Determine whether the compromised endpoint accessed other systems shortly before encryption.

31. Investigate Lateral Movement

Search for connections from:

CYSA-WIN01

to other internal systems.

Review:

SMB
RDP
WinRM
Remote Administration
Authentication Events

Your goal is not to reproduce lateral movement.

Your goal is to identify evidence that it occurred.

32. Pivot on the Compromised User

Search the affected username across the SIEM.

Determine:

Which hosts?

Which timestamps?

Which source IPs?

Which authentication types?

Which privileged sessions?

33. Pivot on CYSA-WIN01

Search:

10.10.10.20

across all network telemetry.

Identify connections to:

Internal Systems
External Systems
DNS Servers
Web Services

34. Investigate Zeek Connections

Search Zeek conn.log data.

Review:

Source
Destination
Port
Protocol
Duration
Bytes Sent
Bytes Received

Look for:

Unusual External Destinations
Large Transfers
Internal SMB Activity
Repeated Connections

35. Investigate DNS Activity

Search DNS telemetry generated by:

CYSA-WIN01

Look for:

Newly Observed Domains
Unusual Domains
Known Malicious Domains
High Query Frequency

Enrich suspicious domains using the workflow from Lab 16.

36. Investigate Suricata Alerts

Search for alerts associated with:

10.10.10.20

Record:

Signature
Category
Severity
Source
Destination
Timestamp

Correlate alerts with endpoint activity.

37. Investigate Possible Command-and-Control Activity

Look for:

Repeated Outbound Connections
Periodic Connections
Rare Destinations
Unexpected Ports
Suspicious DNS

Do not classify traffic as C2 based only on periodic behavior.

Combine:

Network Evidence
+
Endpoint Evidence
+
Threat Intelligence

38. Investigate Potential Data Exfiltration

Review outbound activity before encryption.

Ask:

Was a large amount of data transmitted?

Was unusual archive creation observed?

Were external destinations contacted?

Was cloud storage unexpectedly accessed?

Did outbound traffic increase significantly?

Record findings as:

Confirmed
Suspected
No Evidence Identified
Unable to Determine

Do not claim data theft without supporting evidence.

39. Identify Suspicious Archive Activity

Review process telemetry for unexpected archive creation.

Possible legitimate tools may include:

7-Zip
WinRAR
PowerShell Compression

Their presence alone is not malicious.

Look for:

Large Archive
      +
Sensitive Directories
      +
Suspicious Timing
      +
External Transfer

40. Identify the Ransomware File Hash

Calculate SHA-256 only on the safe simulated ransomware artifact provided for the lab:

sha256sum <simulated-sample>

Record:

SHA-256:
<hash>

Never execute the artifact during investigation.

41. Enrich the Hash

Using approved threat-intelligence sources, determine:

Known / Unknown
Classification
Associated Family
First Seen
Related Infrastructure
Confidence

For a purpose-built lab sample, external intelligence may return:

Unknown

which is acceptable.

42. Build the IOC Inventory

Create:

Type	Indicator	Source	Confidence
Hash	<SHA-256>	Endpoint	High
Domain	<domain>	DNS	High
IP	<IP>	Zeek	Medium/High
File	<filename>	Endpoint	High
Extension	<extension>	File telemetry	Contextual
Ransom Note	<filename>	Endpoint	High

43. Search Every IOC Across the Environment

For each:

Hash
IP
Domain
Filename
User

search the SIEM.

Determine:

Number of Hosts
Number of Users
First Seen
Last Seen
Event Sources

44. Identify Additional Affected Hosts

Suppose:

Ransomware Hash

appears on:

CYSA-WIN01

and:

CYSA-LINUX01

The incident scope has changed dramatically.

Document every affected system separately.

45. Distinguish Compromised and Exposed Systems

Do not classify every contacted system as compromised.

Use categories:

Confirmed Compromised

Suspected Compromised

Exposed / Contacted

Unaffected

Unknown

This prevents unnecessary escalation of scope.

46. Build the Incident Scope Table

Asset	Evidence	Status	Criticality
CYSA-WIN01	Encryption + Process	Confirmed	Medium
CYSA-LINUX01	Network Contact	Exposed	High
CYSA-SIEM	No Evidence	Unaffected	Critical

Update this table as new evidence appears.

47. Identify Affected Users

Create:

User	Host	Evidence	Status
user01	CYSA-WIN01	Interactive session	Affected
admin01	CYSA-WIN01	Privileged logon	Investigate

Identify whether credentials may need to be reset or sessions revoked.

48. Build the Ransomware Timeline

Example:

Time	Stage	Evidence
08:54	Initial Access	Suspicious authentication
09:02	Execution	PowerShell
09:08	Discovery	Host/network enumeration
09:15	Credential Activity	Privileged access
09:21	Lateral Movement	SMB connection
09:28	Network Activity	External destination
09:37	Impact Preparation	Recovery interference
09:42	Encryption	Mass file modification
09:43	Ransom Note	Note created
09:44	Detection	SIEM alert

Your actual timeline should be based on collected evidence.

49. Map Evidence to the Attack Lifecycle

Create:

Initial Access
   ↓
<evidence>

Execution
   ↓
<evidence>

Persistence
   ↓
<evidence>

Credential Access
   ↓
<evidence>

Discovery
   ↓
<evidence>

Lateral Movement
   ↓
<evidence>

Possible Exfiltration
   ↓
<evidence>

Impact
   ↓
<evidence>

If no evidence exists for a stage, record:

Not Observed

rather than inventing activity.

50. Preserve Critical Evidence

Prioritize:

SIEM Events
Windows Logs
Process Telemetry
PowerShell Logs
Network Logs
PCAP
Suspicious Files
Ransom Note
IOC List
Timeline

Use the evidence-handling process from Lab 17.

51. Hash Preserved Evidence

Calculate SHA-256 hashes for preserved files.

Example:

sha256sum <evidence-file>

Create:

LAB18/IOCs/evidence-hashes.txt

Record:

Evidence ID
Filename
SHA-256
Collection Time
Collector

52. Determine Ransomware Impact

Assess:

Confidentiality

Was data accessed?

Was data staged?

Was exfiltration observed?

Integrity

Were files changed?

Were configurations modified?

Were accounts changed?

Availability

Were files encrypted?

Were systems unavailable?

Were business services disrupted?

53. Determine Incident Severity

A ransomware incident involving confirmed encryption should generally be treated as a significant incident.

Consider:

Number of Systems
Asset Criticality
Privilege Compromise
Encryption
Potential Exfiltration
Lateral Movement
Business Disruption
Recovery Impact

For this lab, classify:

Low
Medium
High
Critical

and justify your selection.

54. Determine Whether the Incident Is Active

Ask:

Is encryption continuing?

Are suspicious processes running?

Are malicious connections active?

Are additional hosts being affected?

Are attacker sessions still active?

If yes:

Active Incident

requires immediate containment consideration.

55. Prioritize Containment

For a confirmed active ransomware incident, potential priorities include:

1. Isolate Confirmed Compromised Hosts

2. Restrict Known Malicious Infrastructure

3. Disable or Secure Compromised Accounts

4. Revoke Active Sessions

5. Prevent Lateral Movement

6. Protect Critical Systems

7. Preserve Evidence

8. Hunt for Additional Compromise

Actual response actions must follow organizational incident-response procedures.

56. Isolate the Endpoint Conceptually

Containment may involve:

EDR Network Isolation
Switch Port Isolation
Network Segmentation
Firewall Restriction

The objective is:

Compromised Host
       X
Rest of Environment

Do not power off a system automatically if volatile evidence still needs to be collected.

57. Contain Compromised Accounts

Possible actions include:

Disable Account
Reset Credentials
Revoke Sessions
Rotate Privileged Credentials
Review MFA

Prioritize privileged identities.

58. Block Validated Malicious Indicators

Potential controls:

Firewall
DNS Security
Proxy
EDR
Email Security
SIEM Detection

Only block indicators after considering false-positive and shared-infrastructure risk.

59. Protect Backups

During a ransomware incident, ensure backup infrastructure is not accessible to the attacker.

Security teams should verify:

Backup Integrity
Backup Isolation
Administrative Access
Recovery Credentials
Recent Successful Backups

Do not begin restoration until the environment is considered safe.

60. Do Not Rush to Recovery

The sequence should not be:

Encryption
   ↓
Immediately Restore Everything

Instead:

Detect
 ↓
Contain
 ↓
Scope
 ↓
Preserve Evidence
 ↓
Eradicate
 ↓
Validate
 ↓
Recover

Restoring systems before removing attacker access can result in reinfection.

61. Create Immediate Response Recommendations

Example:

P1 — Immediate

Isolate CYSA-WIN01
Secure affected user account
Preserve volatile evidence
Block validated malicious infrastructure
Search for IOC matches across all endpoints

P2 — Urgent

Review privileged account usage
Investigate lateral movement
Validate backup security
Investigate potential exfiltration

P3 — Follow-Up

Determine root cause
Remove persistence
Patch initial access vector
Restore affected systems
Increase monitoring

62. Identify the Root Cause

Do not stop at:

Ransomware Executed

Determine:

How did the attacker get in?

Potential conclusions:

Phishing
Compromised Credentials
Unpatched Service
Malicious Download
Unknown

If evidence is insufficient, record:

Root Cause:
Undetermined

63. Identify the Initial Compromise Time

The first encryption event is not necessarily the first compromise.

Compare:

Initial Suspicious Authentication
PowerShell Activity
Network Connections
Persistence
Encryption

Determine the earliest defensible point of compromise.

64. Create a Ransomware Incident Summary

Use:

Incident ID:
LAB18-RANSOM-001

Classification:
Simulated Ransomware Incident

Severity:
Critical

Initial Host:
CYSA-WIN01

Affected User:
<user>

Initial Access:
<finding>

Execution:
<finding>

Persistence:
<finding>

Credential Activity:
<finding>

Lateral Movement:
<finding>

Data Exfiltration:
Confirmed / Suspected / Not Observed / Unknown

Impact:
File encryption confirmed

Affected Systems:
<number>

Containment:
Immediate

Escalation:
Incident Response / Security Leadership

65. Create an Executive Summary

Keep the executive summary focused on:

What happened?

What is affected?

Is the threat contained?

Was data potentially exposed?

What is the business impact?

What actions are underway?

Avoid unnecessary technical details.

66. Create the Technical Incident Summary

Technical responders need:

Timeline
Process Tree
Command Lines
Users
Authentication
Hashes
Domains
IPs
Network Connections
Affected Hosts
Persistence
Lateral Movement
Containment Status

67. Mission Challenge — Ransomware Investigation

The SOC asks:

Determine how the ransomware activity began, what systems are affected, whether the attacker moved laterally or potentially accessed data, and what must be contained immediately.

Answer:

1. When was the first suspicious event?

2. What triggered the ransomware alert?

3. Was encryption confirmed?

4. Which files were affected?

5. Was a ransom note created?

6. Which process performed the suspicious activity?

7. What was its parent process?

8. Was PowerShell involved?

9. What was the likely initial access vector?

10. Which user account was involved?

11. Was privileged access obtained?

12. Were credentials potentially abused?

13. Was persistence established?

14. Was security tooling affected?

15. Was backup/recovery functionality targeted?

16. Was system discovery performed?

17. Was network-share discovery observed?

18. Did lateral movement occur?

19. Which systems were contacted?

20. Which systems are confirmed compromised?

21. What external infrastructure was contacted?

22. What IOCs were identified?

23. Does threat intelligence provide additional context?

24. Was archive creation observed?

25. Is there evidence of data exfiltration?

26. What is the earliest defensible compromise time?

27. Is the incident still active?

28. What is the incident severity?

29. What should be contained first?

30. What should the organization investigate next?

68. Document Your Findings

Update:

~/CySA-Lab/Investigations/LAB18/investigation-notes.md

Use:

# LAB18 Ransomware Incident Investigation

## Incident ID

LAB18-RANSOM-001

## Initial Detection

Document:
- alert
- host
- user
- timestamp
- severity

## Initial Access

Document evidence supporting the likely entry vector.

## Authentication

Document:
- failed logins
- successful logins
- source IP
- user
- privilege

## Execution

Document:
- process
- parent
- command line
- timestamp

## PowerShell Activity

Document relevant script telemetry.

## Persistence

Document any persistence evidence.

## Credential Activity

Document potential credential abuse.

## Discovery

Document system and network discovery.

## Lateral Movement

Document:
- source
- destination
- protocol
- user
- evidence

## Network Activity

Document:
- DNS
- IPs
- domains
- ports
- Zeek
- Suricata

## Ransomware Impact

Document:
- file modifications
- encryption indicators
- extension changes
- ransom note

## Potential Exfiltration

Confirmed / Suspected / Not Observed / Unknown

Document supporting evidence.

## Indicators of Compromise

Document:
- hashes
- domains
- IPs
- filenames
- users

## Incident Scope

Classify systems as:
- Confirmed Compromised
- Suspected
- Exposed
- Unaffected
- Unknown

## Timeline

Build the complete sequence of events.

## Evidence

Document preserved evidence and SHA-256 hashes.

## Severity

Low / Medium / High / Critical

## Containment

Document immediate containment priorities.

## Root Cause

Confirmed / Suspected / Undetermined

## Final Assessment

Summarize what happened and what should happen next.

69. Example Analyst Findings

A simulated investigation may conclude:

Incident:
LAB18-RANSOM-001

Classification:
Confirmed Simulated Ransomware Incident

Initial Host:
CYSA-WIN01

Initial Access:
Evidence suggests the incident began with suspicious user activity before the encryption event.

Execution:
PowerShell activity was followed by execution of an unknown simulated ransomware artifact.

Credential Activity:
Suspicious privileged activity was identified and requires additional investigation.

Network Activity:
The endpoint contacted suspicious external infrastructure.

Lateral Movement:
Internal network activity was observed; additional hosts require validation before being classified as compromised.

Impact:
Mass file modifications and simulated encryption indicators were confirmed.

Ransom Note:
Simulated ransom-note artifact identified.

Data Exfiltration:
Insufficient evidence to confirm exfiltration.

Scope:
One endpoint confirmed compromised with additional systems requiring investigation.

Severity:
Critical

Immediate Priority:
Isolate the confirmed endpoint, secure affected identities, preserve evidence, protect backup infrastructure, block validated malicious indicators, and perform enterprise-wide IOC hunting.

70. Evidence to Capture

Capture:

01-initial-ransomware-alert.png
02-file-encryption-indicators.png
03-mass-file-modifications.png
04-ransom-note.png
05-ransom-note-hash.png
06-ransomware-process.png
07-process-tree.png
08-powershell-events.png
09-initial-access-evidence.png
10-authentication-events.png
11-privileged-access.png
12-persistence-evidence.png
13-security-control-events.png
14-backup-interference.png
15-discovery-activity.png
16-lateral-movement.png
17-zeek-network-activity.png
18-dns-activity.png
19-suricata-alerts.png
20-threat-intelligence.png
21-ioc-inventory.png
22-affected-hosts.png
23-incident-scope.png
24-ransomware-timeline.png
25-evidence-hashes.png
26-containment-plan.png
27-executive-summary.png
28-final-assessment.png

71. Validation Checklist

• Initial ransomware alert was preserved

• Investigation window was established

• Alert telemetry was validated

• File-encryption indicators were investigated

• Mass file modifications were identified

• Ransom-note artifact was investigated

• Ransom-note hash was calculated

• Suspected ransomware process was identified

• Process lineage was analyzed

• Windows process events were reviewed

• PowerShell telemetry was reviewed

• Suspicious execution locations were investigated

• Potential initial access was investigated

• Authentication activity was analyzed

• Credential abuse was considered

• Privileged activity was investigated

• Persistence mechanisms were investigated

• New accounts were reviewed where relevant

• Security-control interference was investigated

• Backup/recovery interference was investigated

• Discovery activity was reviewed

• Network-share activity was reviewed

• Lateral movement was investigated

• User activity was correlated

• Zeek telemetry was investigated

• DNS activity was analyzed

• Suricata alerts were correlated

• Potential C2 activity was assessed

• Potential exfiltration was investigated

• Suspicious archive activity was considered

• File hashes were collected

• Threat intelligence was reviewed

• IOC inventory was created

• IOCs were searched across the environment

• Confirmed and exposed systems were distinguished

• Affected users were identified

• Complete incident timeline was built

• Attack lifecycle was reconstructed

• Evidence was preserved

• Evidence hashes were recorded

• Confidentiality impact was assessed

• Integrity impact was assessed

• Availability impact was assessed

• Incident severity was assigned

• Incident activity status was determined

• Containment priorities were documented

• Backup protection was considered

• Root cause was investigated

• Executive summary was created

• Technical incident summary was created

72. Mission Review

In this mission, you investigated ransomware as an incident lifecycle, rather than treating file encryption as an isolated event.

You moved backward from:

Encrypted Files

to reconstruct:

Initial Access
      ↓
Execution
      ↓
Persistence
      ↓
Credential Activity
      ↓
Discovery
      ↓
Lateral Movement
      ↓
Possible Data Collection
      ↓
Possible Exfiltration
      ↓
Encryption
      ↓
Business Impact

You then moved forward into response:

Detection
   ↓
Validation
   ↓
Scoping
   ↓
Evidence Preservation
   ↓
Containment
   ↓
Eradication
   ↓
Recovery

The key lesson is:

The encryption event is often the visible end of a much longer intrusion. A ransomware investigation must determine what happened before encryption and how far the attacker reached.

Skills Developed

After completing this mission, you should be able to:

• investigate ransomware-related alerts

• identify encryption indicators

• analyze mass file modifications

• investigate ransomware artifacts

• analyze suspicious process lineage

• investigate PowerShell activity

• determine potential initial access

• investigate credential abuse

• identify persistence indicators

• detect security-control interference

• investigate recovery interference

• identify discovery behavior

• detect lateral-movement indicators

• analyze network telemetry

• investigate possible command-and-control activity

• assess potential data exfiltration

• enrich ransomware IOCs

• scope affected systems and users

• reconstruct ransomware timelines

• preserve incident evidence

• assess ransomware impact

• prioritize containment

• investigate root cause

• produce technical and executive incident reports

What’s Next?

Lab 19 — Web Application Attack Investigation

You have investigated endpoint, authentication, malware, vulnerability, threat-intelligence, and ransomware incidents.

The next mission shifts the investigation toward an application exposed to users and potentially the Internet.

You will investigate:

• suspicious HTTP requests

• web access logs

• HTTP methods

• status codes

• source IP behavior

• authentication attacks

• suspicious parameters

• SQL injection indicators

• cross-site scripting indicators

• path traversal

• command injection indicators

• web shells and suspicious files

• WAF/security alerts

• server-side evidence

• network telemetry

• threat-intelligence enrichment

• affected accounts

• attack timelines

• incident scoping

• containment recommendations

The workflow progresses from:

Endpoint Incident
      ↓
Host Investigation

to:

HTTP Request
      ↓
Web Application
      ↓
Server Logs
      ↓
Application Behavior
      ↓
Security Telemetry
      ↓
Potential Compromise

➡️ Next: Lab 19 — Web Application Attack Investigation