filmov
tv
Detecting & Hunting Ransomware Operator Tools: It Is Easier Than You Think!
Показать описание
Ryan Chapman, SANS Instructor and author of SANS FOR528: Ransomware for Incident Responders, provides an overview of tools leveraged often by ransomware operators. Though a multitude of ransomware operations and affiliate groups exist, we see a great deal of overlap between the tools leveraged by these groups (and that's an understatement!).
- Are you following and utilizing projects such as Living Off Trusted Sites (LOTS) and Bring Your Own Vulnerable Driver (BYOVD)?
- Are you looking for Bloodhound/SharpHound?
- Do you know how PsExec-like tools work at a forensic level (e.g., smbexec)? Are you hunting for rogue installations of Remote Monitoring & Maintenance (RMM) tools?
- Did you know that data exfiltration tools like Winzip, 7Zip, WinSCP, FileZilla, Rclone, and MEGAsync often leave forensic artifacts that are absolute snitches that are just phenomenal for us cyber defenders?
In this session he will discuss these tools, and show you how they work, and share tips & tricks related to preventing, detecting, and hunting them!
About FOR528: Ransomware for Incident Responders course
About Ryan Chapman
Ryan is a Principal Incident Response Consultant with Palo Alto Networks. He has worked in the Digital Forensics & Incident Response (DFIR) realm for over 10 years. He is the author of the new SANS course on ransomware FOR528: Ransomware for Incident Responders and he has also taught the SANS FOR610: Reverse Engineering Malware. During his career, Ryan has worked in Security Operations Center and Cyber Incident Response Team roles that handled incidents from inception through remediation. With Ryan, it's all about the blue team, including sifting through Packet Captures, researching domains and IPs, hunting through log aggregation utilities, analyzing malware, and performing host and network forensics.
- Are you following and utilizing projects such as Living Off Trusted Sites (LOTS) and Bring Your Own Vulnerable Driver (BYOVD)?
- Are you looking for Bloodhound/SharpHound?
- Do you know how PsExec-like tools work at a forensic level (e.g., smbexec)? Are you hunting for rogue installations of Remote Monitoring & Maintenance (RMM) tools?
- Did you know that data exfiltration tools like Winzip, 7Zip, WinSCP, FileZilla, Rclone, and MEGAsync often leave forensic artifacts that are absolute snitches that are just phenomenal for us cyber defenders?
In this session he will discuss these tools, and show you how they work, and share tips & tricks related to preventing, detecting, and hunting them!
About FOR528: Ransomware for Incident Responders course
About Ryan Chapman
Ryan is a Principal Incident Response Consultant with Palo Alto Networks. He has worked in the Digital Forensics & Incident Response (DFIR) realm for over 10 years. He is the author of the new SANS course on ransomware FOR528: Ransomware for Incident Responders and he has also taught the SANS FOR610: Reverse Engineering Malware. During his career, Ryan has worked in Security Operations Center and Cyber Incident Response Team roles that handled incidents from inception through remediation. With Ryan, it's all about the blue team, including sifting through Packet Captures, researching domains and IPs, hunting through log aggregation utilities, analyzing malware, and performing host and network forensics.
0:31:04
Can you Detect This? | Inside The Ransomware Operator's Toolkit
0:27:14
Hunting Human Operated Ransomware Operators | 2020 Threat Hunting & Incident Response Summit
0:59:38
Learning to Combat Ransomware
0:30:14
Hunting and Scoping A Ransomware Attack
0:06:51
Cybersecurity Threat Hunting Explained
0:58:22
Can You Detect This? Inside The Ransomware Operator’s Toolkit by Peter O
0:51:01
Threat Hunting via Sysmon - SANS Blue Team Summit
0:23:41
The SOC Puzzle: Where Does Threat Hunting Fit? | 2020 Threat Hunting & Incident Response Summit
0:34:38
I Knew You Were Trouble – Detecting Threat Actors Before They Deploy Ransomware
1:01:57
SANS 2021 Ransomware Detection and Incident Response Report
0:56:24
In Hot Pursuit: Tracking Ransomware Actors | Ryan Chapman | Aug 22, 2023
0:01:59
Ransomware operators leveraging VPNs | Red Canary Threat Intelligence
0:57:53
Handling Ransomware Incidents: What YOU Need to Know!
0:47:39
E3 Ransomware : What You Need to Know!
1:18:10
License to Kill: Malware Hunting with the Sysinternals Tools
0:40:01
Ransomware: Creation, Detection, and Response
1:26:09
The Truth about Ransomware: Its not Complicated!
0:27:22
Breaking the Ransomware Tool Set: When a Threat Actor Opsec
0:24:38
Hunting Ransomware- Jupyter Notebook, Sysmon, Windows Security Log
0:30:27
Kemp Demo Ransomware Detection & Response
0:20:41
Hunting Malware with Microsoft Sentinel Threat Intelligence
0:24:55
Unmasking Cyber Shadows: A Tactical Approach to Hunting Ransomware TTPs
0:00:59
Ransomware as the Driver
0:33:05
Ransomware — How to Detect Attacks Before They Become Catastrophic
Комментарии