Ransomware Investigations

Spend even the shortest amount of time in incident response and you will most likely respond to a ransomware investigation. As we saw in the previous chapter, the threat from such attacks is widespread, impacting organizations of every size. These include government entities, large corporations, healthcare, and critical infrastructure. Given the nature of ransomware attacks, analysts and responders should be familiar with how to investigate the common tactics and techniques of ransomware.

In this chapter, we will look at a few of the more common tactics and associated evidence. Specifically, we will examine the following:

• Ransomware initial access and execution
• Discovering credential access and theft
• Investigating post-exploitation frameworks
• Command and Control
• Investigating lateral movement techniques