skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

investigating-ransomware-attack-artifacts

Identify ransomware variants and reconstruct attack timelines from forensic artifacts.

954|172|Updated Mar 13, 2026
Search Tags:#ransomware#incident response#malware analysis#memory forensics#digital forensics#key recovery#event log analysis
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill investigating-ransomware-attack-artifacts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: investigating-ransomware-attack-artifacts
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/digital-forensics/investigating-ransomware-attack-artifacts
Command: npx skills add https://github.com/xalgord/xalgorix --skill investigating-ransomware-attack-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, volatility, yara.

What problem does it solve?

When ransomware strikes, responders must quickly determine the variant, trace how attackers got in, assess encryption scope, and find recovery options — all while preserving volatile evidence like in-memory encryption keys before systems are rebooted.

Core Features & Use Cases

  • Variant Identification: Correlate file extensions, ransom note IoCs (Bitcoin addresses, Tor sites, emails), and binary hashes with services like ID Ransomware and No More Ransom.
  • Attack Timeline Reconstruction: Parse Windows Event Logs, Prefetch, and file timestamps to trace initial access (RDP brute force, phishing), lateral movement, and shadow copy deletion.
  • Recovery Assessment: Check surviving Volume Shadow Copies, backup integrity, and attempt AES/RSA key extraction from memory dumps with Volatility and YARA.
  • Use Case: After a LockBit incident, use this Skill to confirm the variant from multiple signals, prove shadow-copy deletion via vssadmin commands in Prefetch, and produce a report documenting the full attack chain for law enforcement and insurance claims.

Quick Start

Investigate the ransomware incident on the mounted forensic image and identify the variant, initial access vector, and available recovery options.

Frequently Asked Questions about investigating-ransomware-attack-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify which ransomware variant encrypted my files?▼

Identify ransomware variants by correlating multiple signals: ransom note layout, encrypted file samples submitted to ID Ransomware or No More Ransom, and binary hashes. File extensions alone are unreliable because affiliates reuse extensions and many families append random per-victim extensions.

How to recover files after a ransomware attack without paying?▼

Check No More Ransom for free decryptors matching your variant, verify whether Volume Shadow Copies survived, and validate backup integrity. If the host was never rebooted, attempt AES/RSA key extraction from a memory dump using Volatility with YARA rules.

Why should you not reboot a ransomware-infected system?▼

Encryption keys may exist only in RAM, so rebooting destroys the chance of memory-based key recovery. Capture memory first with tools like DumpIt on Windows or LiME on Linux before any shutdown or remediation.

How do I prove ransomware deleted Volume Shadow Copies?▼

Search Prefetch, Event ID 4688, and Sysmon logs for commands like vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete, or bcdedit with recoveryenabled no. Missing shadow copies plus the deletion command is proof; absence alone is ambiguous.

Can partial ransomware encryption still allow file recovery?▼

Yes, intermittent encryption used by LockBit, BlackCat, and Play leaves portions of files intact and potentially recoverable. Inspect the actual file structure before assuming total data loss.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

evidence-acquisition

Acquire and preserve digital evidence with hash verification and chain-of-custody logging.

Community
Advanced
x3fleetsafetyx3fleetsafety
1

acc-subrogation-and-insurance-workflow

Guide motor carriers through subrogation and insurance recovery workflows after fleet crashes.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-network-traffic-for-incidents

Detect C2, lateral movement, and exfiltration in PCAP and flow data.

Community
Advanced
gopforevergopforever

mockup-extract

Extract UI components into a mockup sandbox with rewritten imports and stubbed dependencies.

Community
Advanced