High stakes, low certainty: evaluating the efficacy of high-level indicators of compromise in ransomware attribution