Ransomware Kill Chain Investigator Agent

Inputs (what data the agent consumes)

The agent consumes Microsoft security signals such as Microsoft Defender incident data, Microsoft Entra user and sign-in context, Threat Intelligence data for hashes, IPs, and domains, optional Microsoft Intune device posture, and targeted KQL-based hunting results for ransomware behaviors.

If some signals are unavailable due to permissions, tenant configuration, unsupported dependencies, or retention limits, the agent runs in best-effort mode and reports data gaps and confidence impact instead of failing.

Tasks (what the agent performs)

Investigates ransomware-related incidents, correlates evidence into a kill chain view, enriches users, devices, and indicators, validates hashes, domains, and IPs, runs evidence-led hunts, generates prioritized containment, eradication, and recovery guidance, and supports guided analyst interaction through chat.

Outputs (what results the agent generates)

A consolidated ransomware investigation report including:

• executive summary
• kill chain correlation
• affected assets
• indicator findings
• prioritized response actions
• timeline highlights
• telemetry gap notes.

Estimated SCU consumption

Estimated consumption varies with incident complexity, entity volume, available telemetry, and required enrichment.

Expected consumption per run:

• Low-evidence or no-confirmation cases: around 0.2 to 0.5 SCUs
• Standard single-incident investigation: around 1 to 1.6 SCUs
• Deeper investigations with broader enrichment and hunts: around 1.2 to 1.8 SCUs

Rule of thumb:

• ~0.3 SCUs when no meaningful ransomware path is confirmed
• ~1.6 SCUs for a deeper end-to-end ransomware investigation-

Version 3.3.2

Change log

• Added proactive ransomware hunting in Microsoft Defender XDR, with or without an existing incident.
• Improved detection, entity enrichment, evidence correlation, and MITRE ATT&CK mapping.
• Added evidence-based confidence and coverage tracking to reduce unsupported conclusions.
• Optimized query results and incident processing to prevent context-length errors.
• Removed the direct Microsoft Sentinel workspace dependency and improved overall execution reliability.