Use case 5 – ransomware incident

This raw use case log surfaced in the SOC:

=========================================================================
- Incident ID: 20231117-0723-03
- Timestamp: 2023-11-17T07:23:00Z
- Incident Type: Ransomware Infection
- Source System: Network Security System
- Affected User: [e-mail]
- Affected Device: ALEXSMITH-DESKTOP
- Affected IP: 10.20.30.40
- Incident Details:
  - Alert Description: Ransomware activity detected
  - Detected File: invoice_copy.exe
  - File Path: C:\Users\alex.smith\Downloads\invoice_copy.exe
  - Detection: File executed, file encryption behavior detected
- Initial Detection System: Endpoint Protection Software
- Additional Information:
  - File SHA256 Hash: 12a34b56c78d90e12f34g56h78i90j12k34l56m78n90dt12p34q56r78s90t12u3
  - Network Traffic Anomaly: Increased outbound traffic to IP 198.51.100.55
- Suspected Threat: Ransomware encryption...