> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/advanced-log-analysis/how-to-detect-and-analyze-ransomware-activity-using-logs.md).

# How to Detect and Analyze Ransomware Activity Using Logs

Ransomware attacks encrypt files and demand a ransom for decryption, often spreading across networks and disabling recovery mechanisms. Detecting ransomware requires analyzing logs for abnormal activity patterns related to file changes, processes, and network behavior.

***

## **1. Monitor for Mass File Encryption Activity**

**What to Look For:**

* **File System Logs:**
  * Logs showing a high volume of file modifications or creations in a short timeframe.
  * **Event ID 4663:** Captures access attempts to files and objects.
* **File Extensions:**
  * Sudden renaming of files with unusual or consistent extensions (e.g., `.locky`, `.crypt`, `.encrypted`).

**Red Flags:**\
Bulk modifications of files in user directories or shared drives.

***

## **2. Check for Suspicious Process Activity**

**What to Look For:**

* **Process Creation Events:**
  * **Event ID 4688:** Logs process creation details. Look for:
    * Known ransomware executables or unusual process names.
    * Processes executing from non-standard directories (e.g., `%AppData%`, `%Temp%`).
* **Child Process Activity:**
  * Processes spawning multiple child processes, which may indicate encryption or payload distribution.

**Red Flags:**\
Processes running encoded or obfuscated commands or executing from user directories.

***

## **3. Investigate Volume Shadow Copy Deletion**

**What to Look For:**

* **Shadow Copy Deletion Commands:**
  * Logs showing the execution of `vssadmin delete shadows` or similar commands used to remove backup copies.
* **Key Event IDs:**
  * **Event ID 528:** Logs storage deletion events.

**Red Flags:**\
Deletion of shadow copies or backups, which ransomware often does to disable recovery.

***

## **4. Analyze Network Activity**

**What to Look For:**

* **Unusual SMB Traffic:**
  * **Event ID 5140:** Captures network share access. Look for:
    * Unusual or excessive access to administrative shares (`C$`, `ADMIN$`).
    * Machines accessing multiple network shares rapidly.
* **Propagation Behavior:**
  * Logs showing lateral movement attempts via SMB, RDP, or similar protocols.

**Red Flags:**\
Large-scale access to shared drives, especially from unexpected systems.

***

## **5. Review for Ransom Notes or New Files**

**What to Look For:**

* **File Creation Logs:**
  * **Event ID 4663:** Detects the creation of new files, such as ransom notes (`README.txt`, `DECRYPT_INSTRUCTIONS.txt`).
* **Unusual File Activity:**
  * Files with consistent names appearing across multiple directories.

**Red Flags:**\
Sudden appearance of ransom note files in affected directories.

***

## **6. Immediate Response**

**What to Do:**

* **Isolate Affected Systems:**\
  Disconnect compromised machines from the network to prevent further spread.
* **Disable Network Access:**\
  Block network shares and access points being used by the ransomware.
* **Initiate Incident Response Procedures:**
  * Notify the security team and relevant stakeholders.
  * Begin forensic analysis to determine the scope of the attack.
* **Ensure Backup Integrity:**\
  Verify that backups are intact and uninfected before initiating recovery.
* **Notify Law Enforcement:**\
  Report the incident if required by regulatory or legal frameworks.

**Post-Incident Steps:**

* **Patch Systems:**\
  Address vulnerabilities that allowed the ransomware to execute or spread.
* **Enhance Monitoring:**\
  Deploy detection rules to identify similar activities in the future.
* **Educate Employees:**\
  Conduct training to reduce the risk of phishing or other attack vectors often used to deliver ransomware.

***

## **Conclusion**

Detecting ransomware activity requires monitoring logs for file system changes, process anomalies, and network propagation behavior. Early detection and swift response are critical to minimizing damage and ensuring recovery.

***