Ransomware skills

Honeypot for Ransomware Detection

mukul975

Detect ransomware early with canary files and honeypots.

Implementing Ransomware Backup Strategy

mukul975

Create a resilient backup strategy against ransomware attacks.

Investigating Ransomware Attack Artifacts

mukul975

Forensically analyze ransomware incidents and recover evidence.

Analyzing Ransomware Leak Site Intelligence

mukul975

Monitor and analyze ransomware leak sites for threat intelligence.

Analyzing Ransomware Encryption Mechanisms

mukul975

Assess and reverse-engineer ransomware encryption schemes.

Ransomware Kill Switch Detection

mukul975

Proactively stop ransomware with kill switch analysis.

Detecting Ransomware Encryption Behavior

mukul975

Real-time detection of ransomware encryption activity.

Building Ransomware Playbook

mukul975

Create a ransomware response playbook with CISA guidelines.

Decoy File Deployment for Ransomware Detection

mukul975

Enhance ransomware detection with strategic canary file deployment.

Analyzing Ransomware Payment Wallets

mukul975

Trace ransomware payments using blockchain analysis.

Hunting For Shadow Copy Deletion

mukul975

Proactively detect shadow copy deletion activities.

Ransomware Canary Files

mukul975

Early-warning detection for ransomware attacks.

Immutable Backup with Restic

mukul975

Automate ransomware-resistant backup strategies.

Analyzing Ransomware Network Indicators

mukul975

Detect ransomware network activity through log analysis.

Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker or Controlled Folder Access, or building endpoint protection policies through Group Policy.

Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.

Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.