Temporal Behavioral Archetypes of Ransomware in Active Directory Environments

Ransomware detection in enterprise environments often relies on static signatures or family-specific indicators that fail to generalize across rapidly evolving variants. This paper investigates behavior-based modeling of early-stage ransomware activity within Active Directory (AD) environments using empirical data from 156 controlled execution runs spanning multiple ransomware families. Windows Event Logs from the final 20 minutes of execution are temporally aggregated and represented as multivariate event sequences. Dynamic Time Warping (DTW) is used to align execution dynamics, and density-based clustering (HDBSCAN) identifies recurring behavioral structures without family supervision. Results show that ransomware executions do not form strictly separable family-specific clusters in AD telemetry. Instead, activity converges into a small number of recurring temporal archetypes characterized by multi-stage patterns involving authentication events, system modifications, process creation, and application-level activity. Statistical analysis indicates only moderate association between family label and dominant archetype, highlighting substantial behavioral overlap. These findings suggest that enterprise ransomware detection may benefit more from modeling shared compromise archetypes rather than relying solely on family-specific signatures, highlighting behavioral archetype detection as a shift from family-bound classification toward convergence-based detection in Active Directory environments.