A Behavioral Analysis of Ransomware in Active Directory: A Case Study of BlackMatter, Conti, LockBit, and Midnight

Ransomware continues to be a pervasive cyber-security threat, particularly in enterprise environments that leverage Active Directory (AD) for centralized management. This study focuses on analyzing ransomware behavior by ex-amining Windows Event Logs generated during attacks from four prominent ransomware families: “BlackMatter,” “Conti,” “LockBit,” and “Midnight”<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup>The “Midnight” samples included in this study were labeled as such in the dataset [1]–[3]. Although not a commonly recognized ransomware family in public reports, they demonstrate typical ransomware behaviors, including encryption and system compromise.. We conducted experiments on 20 ransomware samples (5 per family) within a controlled Proxmox-based virtual AD environment to simulate realistic enterprise conditions. Our analysis applies n-gram sequence modeling and behavioral feature extraction to uncover distinctive event patterns and attack paths. The findings reveal consistent, family-specific behavioral sequences, such as repetitive service control and credential validation events, that are indicative of ransomware activity. In addition to offering insight into the operational methods of ransomware, we lay the groundwork for automated behavior-based detection mechanisms suited for enterprise AD environments.