{
  "source_id": "ms-human-operated-ransomware-2020",
  "source_key": "ms-human-operated-ransomware-2020",
  "title": "Human-operated ransomware attacks: A preventable disaster",
  "publisher": "Microsoft Security",
  "source_url": "https://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/",
  "originally_published": "2020-03-05T17:00:31+00:00",
  "most_recently_updated": "2025-06-27T06:58:35+00:00",
  "first_collected": "2026-10-22T19:50:55+00:00",
  "last_successfully_checked": "2026-10-22T19:50:55+00:00",
  "original_content_digest": "be17c43bdbcc4a60e1e45b9cc05804aba86543149f2af5e6b1941813d9dffad9",
  "source_publication_date": "2020-03-05",
  "date_precision": "timestamp",
  "affected_platform": "Windows / enterprise networks",
  "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
  "review_decision": "include",
  "reason_codes": [
    "editor-approved",
    "Original Microsoft report describes an observed clearing behavior, not only a general recommendation or hypothetical vulnerability. Relevant to loss of local event history and corroboration with surviving records."
  ],
  "editorial_annotation": "Microsoft describes event-log clearing within observed human-operated ransomware activity. The investigative implication is to compare native endpoint channels with retained central copies and collection status; a gap by itself does not attribute an actor.",
  "topic": "Log visibility",
  "evidence_quote_reference": {
    "short_quote": "the group clears event logs",
    "section": "Reviewed original report; locate the quoted phrase in context."
  },
  "editor_reviewed": "2026-10-22",
  "historical": true,
  "related_guide_urls": [
    "https://anti-forensics.com/reference/artifacts/security-log-clear-records/",
    "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
    "https://anti-forensics.com/reference/field-guides/corroborating-a-timeline/"
  ],
  "record_version_digest": "dec30451c17fbcae60fded55d5e1f19eeb82e94a06417bb01fc3f8b261be470f"
}