FOR528: Ransomware and Cyber Extortion
About This Course
FOR528: Ransomware for Incident Responders provides the hands-on training required for those who may need to respond to ransomware incidents. The term "Ransomware" no longer refers to a simple encryptor that locks down resources. The advent of Human-Operated Ransomware (HumOR) along with the evolution of Ransomware-as-a-Service (RaaS) have created an entire ecosystem that thrives on hands-on the keyboard, well-planned attack campaigns. Our course uses deftly devised, real-world attacks and their subsequent forensic artifacts to provide you, the analyst, with all that you need to respond when the threat become a reality.
What You'll Learn
The course also provides in-depth details and detection methods for each phase of the ransomware and cyber extortion attack lifecycle. These phases include Initial Access, Execution, Defense Evasion, Persistence, Attacks on Active Directory (AD), Privilege Escalation, Credential Access, Lateral Movement, Data Access, Data Exfiltration, and Payload Deployment.
Unfortunately, many businesses will find themselves falling victims to ransomware attacks because they feel they are not in danger. Regardless of whether your organization is small, medium, or large, every internet-connected network is at risk... and the threat is not going away any time soon.
Entry Requirements
A background in Incident Response (IR) is suggested. This course is aimed toward the incident responder who needs to respond to ransomware attacks. Thus, IR experience or at least alert triage experience such as one acquired within a SOC or CIRT is recommended. Additional recommended experience includes Windows artifact identification and analysis, such as one learns in FOR500: Windows Forensic Analysis. Finally, we recommend familiarity with regular expressions (regex) along with general SIEM use. All these items are covered in the course, but the general idea is to have experience working incidents. Participants should be proficient in written and spoken English. There are no minimum entry requirements for years of experience in the domain, education level or age group; but participants should possess the relevant prerequisite skills mentioned above before taking the course.