This simulated log dataset represents a full human-operated ransomware intrusion, showing how the attack would realistically appear across authentication logs, endpoint telemetry, network logs, and file system events. The key takeaway is that the ransomware execution is the final step, while most detectable activity happens days earlier.
Phase 1 — Initial Access (Credential / Phishing)
- A service account successfully logs in via remote access (VPN/RDP) from an unfamiliar external IP during non-business hours.
- This is the first high-confidence indicator of compromise.
- No malware is visible yet; access is obtained using valid credentials.
🔐 VPN / RDP Authentication Logs
⚠️ Red flags
- Service account used interactively
- Login time outside business hours
- New external IP never seen before
Phase 2 — Command Execution & Persistence
🖥️ Endpoint Process Creation (EDR / Sysmon)
- An email client spawns hidden, encoded PowerShell, indicating post-phishing execution.
- A scheduled task is created with a legitimate-looking name but launches a malicious DLL.
- Persistence is established quietly to survive reboots.
⚠️ Red flags
- Encoded PowerShell
- Outlook spawning PowerShell
- Hidden window + no profile
🗂️ Scheduled Task Creation
⚠️ Red flags
- Masquerading task name
- DLL execution via rundll32
- Non-standard DLL location
Phase 3 — Internal Reconnaissance
🧭 Active Directory Enumeration
- The compromised account enumerates Active Directory objects and admin shares (ADMIN$).
- Access patterns indicate mapping of servers and trust relationships.
⚠️ Red flags
- ADMIN$ access
- Service account enumerating AD
- Broad share enumeration
Phase 4 — Credential Dumping
🔑 LSASS Access Attempt
- A non-security process attempts to access LSASS memory, a strong indicator of credential dumping.
- Attackers gain administrative-level credentials, enabling unrestricted movement.
⚠️ Red flags
- LSASS memory access
- Non-security tool accessing lsass
- Full access mask
Phase 5 — Lateral Movement
🔄 Remote Service Creation (PsExec-style)
- New services are created remotely on multiple server.
- Administrative credentials are reused across systems via SMB.
- Multiple internal logons originate from a single compromised host.
⚠️ Red flags
- Service creation from remote host
- Admin credentials reused
- SMB-based lateral movement
Phase 6 — Data Staging & Exfiltration
📦 File Compression Activity
- Large volumes of sensitive files are compressed locally.
- Multi-gigabyte encrypted outbound traffic flows to unknown destinations.
🌐 Large Outbound Transfer (Firewall / Proxy)
⚠️ Red flags
- Large encrypted transfer
- Non-business destination
- Occurs before ransomware
Phase 7 — Pre-Encryption Destruction
🧨 Backup & Recovery Removal
- Shadow copies and system recovery options are deliberately disabled.
- These commands precede ransomware execution by minutes to hours.
⚠️ Red flags
- Shadow copy deletion
- Recovery disabled
- Strong ransomware precursor
Phase 8 — Ransomware Execution
🔐 Mass File Encryption
- Mass file write/rename operations occur at high speed.
- Unknown executables encrypt files and drop ransom notes.
- Multiple systems encrypt simultaneously, indicating centralized control.
⚠️ Red flags
- Rapid rename/write cycles
- Unknown executable
- High file entropy
📝 Ransom Note Creation
Phase 9 — Domain-Wide Impact
🧨 Group Policy Push (Optional but Observed in Some Cases)
- Potential Group Policy changes allow rapid execution across systems.
- Critical government services become unavailable nearly at once.
⚠️ Red flags
- GPO changes during incident
- Used for mass execution
Phase 10 — Aftermath Indicators
- Earliest reliable detections: credential misuse, PowerShell abuse, LSASS access
- Most damaging phase: data exfiltration, not encryption
- Root cause: identity and privilege control failure
- Encryption is the final symptom, not the initial problem
