Collecting data sources for an external remote service abuse investigation

First of all, we need to collect the appropriate data in order to identify the initial compromise vector. In many cases, my team already has a shortlist of techniques most likely to be used, based on an observed threat actor's behaviors. Of course, in real investigations, we usually figure out the details about the initial access technique used toward the end of the analysis, as we usually start from one of the encrypted hosts and deal with the impact. But in this and the following chapters, we'll look at artifacts step by step as if we are looking at the ransomware attack life cycle from the beginning to the end. You can always do the same analysis steps in reverse order in your real investigations.

As is the case for many ransomware incidents, there are no advanced security products installed; we'll focus on approaches and artifacts available almost always.

So, analyzing external remote...