The data collected for the paper "Ransomware in Active Directory: A Dataset and Analysis of Early-Stage Behavior" which was accepted for the CSET Workshop 2025 at ACSAC.
The dataset captures the first 20–25 minutes of behavior across multiple ransomware families executed in a controlled Active Directory (AD) environment, with both victim and server perspectives recorded. All preprocessing, windowing, and evaluation scripts used in the paper are included to support full reproducibility.
- Unzip all CSV files contained in the data/ directory.
- Open the provided Jupyter notebook (AD_early_stage_analysis.ipynb) and run all cells to reproduce the figures, metrics, and results reported in the paper.
If you use this dataset, code, or methodology in your research, please cite our paper:
Temporary citation (to be updated once the official CSET 2025 proceedings are published):
@inproceedings{bhandary2025ransomwareAD, title={Ransomware in Active Directory: A Dataset and Analysis of Early-Stage Behavior}, author={Bhandary, Prajna and Nicholas, Charles and Joyce, RJ and Li, Bojing}, booktitle={CSET Workshop ACSAC}, year={2025} }