Ransomware file encryption
Named by 2 kept items in this workspace.
Search every workspace for Ransomware file encryption. It matches the name as written, so it can find other things that share it.
The items that name it 2
Akira ransomware launched against subfolders beneath a Shares folder, evidenced by Akira log files and corresponding PowerShell shadow copy removal commands, repeated four times across different subfolders
Identified via newly created file extensions, ransom-note files and timestamps to distinguish active encryption from older artefacts in an anonymised ransomware investigation
All techniques in this workspace.