New

FOR528: Ransomware and Cyber Extortion

  • In Person (4 days)
  • Online
24 CPEs
FOR528: Ransomware for Incident Responders provides the hands-on training required for those who may need to respond to ransomware incidents. The term "Ransomware" no longer refers to a simple encryptor that locks down resources. The advent of Human-Operated Ransomware (HumOR) along with the evolution of Ransomware-as-a-Service (RaaS) have created an entire ecosystem that thrives on hands-on the keyboard, well-planned attack campaigns. Our course uses deftly devised, real-world attacks and their subsequent forensic artifacts to provide you, the analyst, with all that you need to respond when the threat become a reality.

What You Will Learn

Learning to thwart the threat of human-operated ransomware once and for all!

The term "Ransomware" no longer refers to a simple encryptor that locks down resources. The advent of Human-Operated Ransomware (HumOR) along with the evolution of Ransomware-as-a-Service (RaaS) have created an entire ecosystem that thrives on hands-on the keyboard, well-planned attack campaigns. It is a rapidly growing threat that has evolved from being a single machine infection following an ill-advised mouse click to becoming a booming enterprise capable of crippling large and small networks alike. Even when extortion actors do not deploy an encryptor, the fallout can be devastating.

Organizations are at risk of losing their data and information to these attacks, which can lead to revenue losses, reputational damage, theft of employee time and productivity, and inability to function normally. It is now common to see these large-scale, sophisticated attacks where the ransomware actors first establish persistence and execute tools on their target, then move laterally throughout the organization, and ultimately exfiltrate data before deploying their ransomware payloads. That is, if they even deploy an encryptor.

Even though payments to ransomware actors slowed in early 2022 as compared to previous years, that same year there were over 2,600 posts made to extortion sites related to ransomware. This number does not include an unknown quantity of incidents that were resolved through communication and/or negotiation behind the scenes prior to public notification. Of the reported incidents from 2022, the following are the top 10 compromised sectors:

  • Construction
  • Hospital and Health Care
  • Government Administration
  • IT Services and IT Consulting
  • Law Practice
  • Automotive
  • Financial Services
  • Higher Education
  • Insurance
  • Real Estate

The FOR528: Ransomware and Cyber Extortion course teaches students how to deal with the specifics of ransomware to prepare for, detect, hunt, respond to, and address the aftermath of these attacks. The course features a hands-on approach to learning using real-world data and includes a full day capture the flag (CTF) challenge to help students solidify their learning. The four-day class teaches students what artifacts to collect, how to collect them, how to scale collection efforts, how to parse the data, and how to review the parsed results in aggregate.

The course also provides in-depth details and detection methods for each phase of the ransomware and cyber extortion attack lifecycle. These phases include Initial Access, Execution, Defense Evasion, Persistence, Attacks on Active Directory (AD), Privilege Escalation, Credential Access, Lateral Movement, Data Access, Data Exfiltration, and Payload Deployment.

Unfortunately, many businesses will find themselves falling victims to ransomware attacks because they feel they are not in danger. Regardless of whether your organization is small, medium, or large, every internet-connected network is at risk... and the threat is not going away any time soon.

Ransomware and Cyber Extortion Course Topics:

  • Ransomware Evolution and History
    • First-recognized ransomware attack
    • Human-operated ransomware (HumOR)
    • Ransomware-as-a-Service (RaaS)
  • Windows Forensics Artifacts Critical to Ransomware Incident Response:
    • Windows event logs
    • Shellbags
    • Shimcache
    • System Resource Usage Monitor (SRUM)
    • Windows New Technology File System (NTFS) metadata analysis
    • Artifacts as denoted in the SANS "Windows Forensic Analysis" poster
  • Evidence Acquisition Tools and Techniques
  • Parsing Forensic Artifacts
  • Ingesting Parsed Data Into a Security Information and Event Management (SIEM) solution
  • Analyzing SIEM/Aggregator Data via TimeSketch and Kibana
  • Initial Access
    • Remote Desktop Protocol (RDP)
    • Phishing
    • Software vulnerabilities
  • Execution and Defense Evasion
    • Threat actor tooling
    • Security tool bypass methods and scripts
    • Native execution methods
    • Scripting engine abuse and script deobfuscation
  • Persistence
    • Command and Control (C2) frameworks and Remote Monitoring and Management (RMM)
    • Post-exploitation frameworks
    • Native Windows persistence mechanisms
  • Cobalt Strike
    • Architecture, components, and payloads
    • Access and uses by extortion threat actors
  • Privilege Escalation and Credential Access
    • Commonly targeted accounts and methods of access
    • User Account Control (UAC) bypass
    • Local Security Authority Server Service (LSASS) and NTDS.dit attacks
  • Lateral Movement
    • RDP
    • Server Message Block (SMB)
    • Windows Remote Management (WinRM)
  • Active Directory (AD) Attacks
    • Overview of AD and Kerberos
    • AD enumeration
    • Kerberoasting
    • AS-REP roasting
    • DCSync attacks
  • Data Access
    • Network share enumeration and access
    • File/folder access including deleted files
    • Registry analysis
  • Data Exfiltration
    • Archive creation and data staging
    • Data exfiltration routes
  • Backup and Recovery Tampering
  • Payload Deployment
  • Encryption Specifics Including Source Code Review
  • Decryptors
    • Dealing With an Active Threat
  • Pre-encryption, during encryption, and post-encryption
  • Hunting Methods and Techniques

Notice: For multi-course live training events, there is an 8:30-9:00am setup time on the first day to ensure sure that computers are configured correctly in order to make the most of class time. All students are strongly encouraged to attend.

What Is Ransomware and Cyber Extortion?

While ransomware incidents involve entry into an environment usually with the goals of exfiltrating data and then encrypting resources, cyber extortion groups perform the same types of attacks, yet do not encrypt the environment. In essence, an incident following common ransomware TTPs/IOCs that does not involve encryption is often referred to simply as cyber extortion.

Business Takeaways

  • Bolster defenses by implementing preventative measures to stop ransomware actors from gaining access to your organization
  • Quickly detect when a ransomware actor has gained access to your environment and is leveraging tools common to the trade
  • Identify what ransomware attacks look like to help work out a plan for responding if it's detected on the network
  • Respond quickly through understanding where to focus your efforts given your unique environment
  • Identify which backups to use for restoration to ensure successful restoration while avoiding restoring threat access persistence within your environment.
  • Determine if an identified actor within your environment is affiliated with ransomware.
  • Identify what data may have been accessed, how, and when
  • Identify what data may have been exfiltrated by a ransomware actor (This course prepares you for the [GWEB] certification that meets the requirements of the DoD8140 IAT Level 2)

Skills Learned

The FOR528: Ransomware and Cyber Extortion course will help you understand:

  • How ransomware has evolved to become a major business
  • How HumOR operators have evolved into well-tuned attack teams
  • Who and what organizations are most at risk of becoming a ransomware victim
  • How ransomware operators get into their victim's environments
  • How to respond when ransomware is actively running within your environment
  • What steps to take following a ransomware attack
  • How best to prepare your organization against HumOR threats
  • How to identify the tools that HumOR operators often use to get into a system and perform post-exploitation activities during a ransomware attack
  • How ransomware and cyber extortion campaigns differ
  • How to hunt for ransomware operators within your network
  • How to identify data access and exfiltration

Hands-On Ransomware and Cyber Extortion Training

SANS labs provide hands-on experience that reinforces course concepts and learning objectives. This course includes lab instructions with a step-by-step electronic workbook that's directly tied to the material to develop skills in a hands-on environment.

Lab 0: Virtual Machine Setup

Lab 1.1: Analysis of a RaaS Ecosystem (RAASNet)

Lab 1.2: Acquiring and Analyzing Artifacts

Lab 1.3: Analysis at Scale: TimeSketch

Lab 2.1: Analysis at Scale: Kibana

Lab 2.2: Finding the Infection Vector

Lab 2.3: PowerShell Scripting: Foe, not Friend

Lab 2.4: Decoding Cobalt Strike Payloads

BONUS Lab 2.5: Hunting RDP Activity

Lab 3.1: Identifying Lateral Movement

Lab 3.2: Identifying Data Access and Exfiltration

Lab 3.3: Detecting the Threat Actor's Toolbox

BONUS Lab 3.4: Additional Lateral Movement

Day 4: FOR528 CTF Challenge

What You Will Receive

  • Course-specific/custom Windows 10 Enterprise version of the SIFT Workstation VM with Free and Open-Source Software (FOSS) and freeware Digital Forensics and Incident Response (DFIR) tools prebuilt into the environment.
  • This VM includes KAPE-acquired Windows forensic artifacts from all 15 hosts that make up the target network range/environment.
  • Course-specific/custom version of the Linux SIFT Workstation VM.
  • This VM includes both Scenarios 1 and 2 data contained within an Elasticsearch instance accessible via both TimeSketch and Kibana.
  • ISO image containing both VMs along with archival tools to aid in installation and setup.
  • FOR528 exercise workbook including detailed step-by-step instructions for all labs.

Syllabus (24 CPEs)

Download PDF
  • Overview

    The Ransomware and Cyber Extortion course begins with a review of ransomware’s history. We begin with the story of the first-known ransomware attack and work our way to the current-day threats that loom over our industry. Our inner-connected lives, not to mention livelihoods, are at risk everyday thanks to the advent of HumOR and RaaS. You will increase your understanding of ransomware as we deep-dive into the roles, processes, communication methods, and activities related to these threats.

    We then cover what to do if you are about to be encrypted, are currently being encrypted, or were just recently encrypted. We cover the actions you need to take including the entities you need to contact, the departments you need to involve, and the processes you need to put in place with special attention to temporal requirements – The clock is ticking!

    After learning about the true threats we face and how we can apply incident response practices in general, we begin our deep-dive into the Windows-based forensic artifacts best suited to ransomware campaign analysis. You’ll learn which artifacts to collect along with which tools and methods are best suited to acquisition and parsing. Regardless of your organization’s level of preparedness, we’ll cover what you can do to obtain data that will facilitate analysis.

    You’ll learn the hands-on approaches for direct acquisition against single machines and then transition to acquisition and analysis at-scale. Detailed hands-on labs walk you through analysis methods for each environment type. You’ll use TimeSketch to analyze parsed artifacts, ensuring that you recognize the easy wins and more advanced analysis practices to help you and your organization respond to the ransomware threat.

    Exercises
    • Install the customized FOR528 Windows and SIFT virtual machines (VMs), configuring them as required for detailed log review and malware analysis.
    • Utilize a ransomware "builder" to generate a customized ransomware encryptor payload along with a decryption tool. You will run the ransomware payload you generate, review the encrypted files, and then use the decryption tool to decrypt the data.
    • Review forensic artifacts collected from a compromised environment and then parse the data using the Kroll Artifact Parser and Extractor (KAPE). Utilize Timeline Explorer to review data parsed via KAPE while focusing on Master File Table (MFT), SRUM, Shellbags, Shimcache, and Windows Event Log artifacts.
    • Hunt data within the TimeSketch interface while focusing on how analysis of MFT, SRUM, Shellbags, Shimcache, and Windows Event Log scales when moving from the previous lab's manual analysis to at-scale analysis.
    Topics
    • Course VMs
      • Overview and setup
    • Review of Our Custom Target Victim and Their Network
    • Custom Attack Scenarios Overview - Labs and CTF are based on these attacks:
      • "BlueLocker" ransomware group
      • "Balrog" ransomware group
    • Ransomware Evolution and History
      • First-recognize ransomware attack
      • Lockers and single-machine encryption payloads
      • HumOR
    • Ransomware-as-a-Service (RaaS)
      • RaaS model, hierarchies, and roles
      • RaaS builders and generators
      • RaaS dashboards
    • Initial Access Brokers (IABs)
      • Methods of access
      • Darknet marketplaces
      • Victim access: selling vs. buying
    • Ransomware Operators
      • Group evolution over time
      • Types of extortion
      • Data leak sites and psychological pressures
      • Darkweb forum communications
    • Dealing with an Active Threat
      • Time considerations
      • Informed consent
      • Departments and roles that need to be involved
      • "Going dark" - a.k.a. cutting Internet connectivity
      • Securing critical services and functions
      • What you need to do now vs. later
    • Ransomware Payments
      • Cons regarding payment
      • Pros regarding payment
      • Threat actor communications and negotiations
    • Forensic Artifact Collection
      • Review artifacts collected by KAPE
      • Process/parse collected artifacts using KAPE
      • Review the output of parsed artifacts to better understand the tools and methodologies leveraged to parse the forensic data for review
    • Incident Response Processes and Their Application to Ransomware
      • Dynamic Approach to Incident Response (DAIR) model
      • Phases of a typical ransomware campaign
    • Windows Forensic Artifacts
      • Event logs, Shellbags, Shimcache, SRUM, and more
      • Review of the SANS "Windows Forensic Analysis" poster
      • Using Timeline Explorer to analyze CSV file output by common parsing tools
      • Artifact collection tools
      • Acquiring forensic artifacts
    • Analysis at Scale
      • Using Velociraptor to collect in bulk
      • Log augmentation via Sysmon
      • Log auditing review via Log-MD
      • Log aggregators/SIEMs and file names
    • Analysis at-scale via TimeSketch
  • Overview

    Ransomware incidents are not especially unique - We incident responders see the same tactics, techniques, and procedures (TTPs) over and over... So, let's learn how to detect them!

    Section two begins with a hands-on lab for Kibana, a secondary log aggregation graphical user interface useful for facilitating ransomware and cyber extortion investigations. We then transition from artifact analysis to covering the initial stages of a ransomware campaign attack cycle. We begin by covering Initial Access, Execution, Defense Evasion, and scripting engine abuse. Most ransomware cases involve actors leveraging scripting engines such as PowerShell, Batch scripts, JavaScript, Visual Basic Scripting, and more.

    We next discuss the various tools and scripts that we see time and again, providing an overview of each tool along with details for hunting and detection. Next, we move to discussing Persistence. You'll learn about common C2 mechanisms, RMM solutions, and native Windows methods ransomware operators use to maintain access to an environment.

    We then pivot to an in-depth review of Cobalt Strike (CS), an adversary emulation and attack simulation tool that has become perhaps "too" good at its job. Many security professionals around the world such as penetration testers and red teams rely on CS. Unfortunately, we see this extremely powerful commercial tool in a very high percentage of ransomware attacks. You will learn about the tool's infrastructure, malleable C2 profiles, payload detection/deobfuscation methods, and more. This module includes a hands-on lab in which you will learn to decode CS payloads.

    Much of our training is punctuated with hands-on labs that walk you through analysis methods step-by-step. We aim to ensure that both those with experience and those newer to the realm of incident response can work a ransomware or cyber extortion incident from beginning to end.

    Exercises
    • Learn the ins-and-outs of the most common interface associated with Elasticsearch, Logstash, and Kibana (ELK) stacks while adapting skills acquired in previous labs.
    • Identify successful phishing attacks via hunting Microsoft Office applications as parent processes, zip files opened natively in Windows, zip file credential read operations, Outlook downloading/executing files, and review of the Microsoft Trust Center.
    • Learn to analyze encoded and obfuscated PowerShell payloads.
    • Decode and analyze CS payloads including PowerShell shellcode injectors and "stageless" beacon EXE and DLL loaders.
    • Hunt malicious RDP activity to identify initial infection vectors and internal-to-internal lateral movement.
    Topics
    • Analysis At-Scale via Kibana
    • The Phases of a Ransomware Attack Campaign Covered in Section 2:
      • Initial access
      • Execution
      • Defense evasion
      • Persistence

    The following sections include in-depth details on the tools, processes, and methods for detection and hunting.

    • Initial Access
      • Top 3 initial access methods: RDP, phishing, and software vulnerabilities
      • Phishing vectors
    • Malware infection vs. credential harvesting
    • Malicious attachments such as MalDocs
    • Review of our Email Gateway File Block List
    • Malicious links and how to analyze them
      • Remote Desktop Protocol (RDP)
    • Useful Windows Event Logs
    • Identifying malicious RDP activity
      • Software exploits / Vulnerabilities
    • Zero-day vs. Common Vulnerabilities and Exposures (CVEs)
    • Example CVEs targeted and exploited in the wild
    • Darknet forum discussions
      • Malware-as-a-Service (MaaS)
    • Execution and Defense Evasion
      • Threat actor tooling
    • Free and Open-Source (FOSS)
    • Native scripting engines
    • Living Off the Land Binaries and Scripts (LOLBAS)
    • Commercial tooling for adversary emulation
    • MaaS
      • Security service/mechanism bypass methods
      • Native execution methods
      • Windows Management Instrumentation (WMI) attacks
      • Scripting engine abuse
    • PowerShell
    • Batch scripts
    • JavaScript scripts
    • Visual Basic Scripting
      • PowerShell logging and advanced analysis
    • Associated Windows Event Logs and enabling them
    • PowerShell parameters and their purposes
    • Persistence
      • Common C2 methods
      • Remote Monitoring and Management (RMM)
      • Post-exploit frameworks
      • Account creation
      • Boot/logon auto-start locations
      • Service installations
      • Scheduled tasks
      • WMI event subscriptions
    • Cobalt Strike (CS)
      • Threat actor access and utilization
      • CS architecture and components
      • Malleable C2 profiles
      • Commands and cheat sheets
      • Detection methods
      • Payload decoding tools and methods
  • Overview

    Section three begins with Privilege Escalation, Credential Access, and Lateral Movement. What tools do ransomware actors use to escalate privileges on machines? How do they access stored credentials from Windows hosts? What processes are often dumped, why, and how? For lateral movement you'll learn about how RDP, SMB (specifically PsExec), WinRM, and other methods are used to move throughout the victim network.

    We then turn our attention to attacks against Microsoft's AD. Ransomware operators love to attack AD, so we'll break down the various ways in which they take advantage of poor AD configurations to escalate privileges and access credentials.

    We continue the attack lifecycle with one of the more critical sections of the course -- Data Access and Data Exfiltration. Organizations usually want to know what data may have been accessed and/or stolen. We cover data archival and staging methods, including ways to hunt the tools that facilitate these activities. Would you believe that FTP is a common exfiltration route? How can you best detect data being exfiltrated even if you don't know what data is being exfiltrated? We'll show you!

    We then move to the final phase of the ransomware attack, Payload deployment and the inner workings of encryption. You'll learn about backup and recovery tampering along with the methods by which ransomware actors attack backup systems. The ways in which actors cover their tracks might seem obvious, because they are! We end this section with technical details pertaining to the most common payload deployment methods.

    Finally, we cover hunting methods such as identifying renamed executables, malicious files/processes via directory analysis, common attacks via anti-virus log analysis, and more. This is where we show you the best ways to keep an eye on your organization.

    Exercises
    • Identify lateral movement via mechanisms such as RDP and PsExec.
    • Hunt and identify data access and potential exfiltration via hunting and pivoting through NTFS metadata (NTFS, UsnJrnl, etc.), manual parsing of acquired artifacts, Timeline Explorer, TimeSketch, and Kibana.
    • Detecting the threat actor's toolbox via hunting methods such as detecting PSTools, renamed executables, common directories, and more.
    • Identify additional lateral movement including WMI, Cobalt Strike, and more.
    Topics
    • The Phases of a Ransomware Attack Campaign Covered in Section 3:
      • Privilege escalation
      • Credential access
      • Lateral movement
      • Attacks against AD
      • Data access
      • Data exfiltration
      • Payload deployment
    • Privilege Escalation and Credential Access
      • Commonly targeted accounts
      • Methods by which accounts are targeted
      • User Account Control (UAC) bypass methods
      • Local Security Authority Server Service (LSASS) access and dumping
      • NTDS.dit attacks
      • Alternate credentials attacks
    • Attacks on passwords stored in browsers and password management tools
    • Session sniffers and extractors
    • Commonly seen all-in-one solutions (e.g., WinPwn)
    • Lateral Movement
      • RDP and RDP cached bitmap analysis
      • Server Message Block (SMB) lateral movement
      • Named pipe utilization and relation to service installs
      • SysInternals PsExec
      • Windows Remote Management (WinRM)
      • Attacks against ESXi
    • AD Attacks
      • AD enumeration
      • Bloodhound and SharpHound
      • Kerberoasting
      • AS-REP roasting
      • DCSync attacks
      • Golden ticket attacks
    • Data Access
      • Reporting and legal considerations
      • Network share enumeration and access
      • Deleted file and file knowledge
      • File and folder access
      • Registry analysis
      • Tool-specific analysis
    • Data Exfiltration
      • Archive creation
      • Data staging
      • Creation/use of .txt and .csv files
      • Data exfiltration routes
      • Network log and NetFlow review
    • Backup and Recovery Tampering
      • Volume Shadow service attacks
      • Boot configuration data, Windows boot status policy, and Windows backup attacks
      • Event log clearing
    • Payload Deployment
      • Common deployment tools and methods
      • Deployment via PsExec
      • Deployment via Windows Management Instrumentation Command-line (WMIC)
      • Deployment via Background Intelligent Transfer Service (BITS)
    • Encryption and Decryptors
      • Encryption key types
      • Overwrite vs. copy/delete encryption methods
      • Ransom notes
      • Encryption mechanism source code review
      • Decryptors
    • Hunting Ransomware Operators - Techniques to Identify
      • Malicious RDP connectivity
      • Process name and path anomalies
      • Rogue/malicious executables
      • PowerShell encoded commands
      • Malicious activity in antivirus logs
      • Malicious activity involving environment variables
  • Overview

    Nothing, and we mean nothing, can better prepare you to respond to ransomware incidents than experience. Since you do not want to gain such experience within your organization, we provide a full day CTF challenge where you will analyze ransomware incidents from the infection vector all the way through the encryption payload running within the environment. We have crafted a victim organization, Samaran Protect, to which you can most likely relate your organization.

    Our CTF challenge consists of 50 questions pertaining to a specially crafted attack scenario against our victim organization. Our target victim's network includes 15 hosts located within three VLANs:

    FOR528 VLAN Infographic

    To carry out these attacks, we devised two different ransomware groups, each of which is an amalgamation of currently operating ransomware threat groups. The TTPs leveraged mirror real-world scenarios that those responding to ransomware events see every day. The actors involved in each scenario use different entry methods, credential access methods, tooling, deployment methods, and encryptor payloads.

    Furthermore, each scenario mimics a different type of environment: one in which the victim organization does not purposefully collect forensic data to aid in incident response and one in which the victim is well-tooled and is ready for anything. Whether your organization needs to begin all artifact collection and parsing post-incident, or you have augmented your data logging and take advantage of a full-fledged SIEM, the methods we cover in our Capstone will help you relate to your organization's methods and capabilities.

    Exercises
    • A full day of analyzing parsed forensic artifacts and logs in two different scenarios to answer questions common in every ransomware incident.
    • Utilizes SANS' new ranges.io platform.

    Scenario 1: "BlueLocker" Ransomware

    Scenario 2: "Balrog" Ransomware

    Topics
    • Digital Forensics Capture the Flag Event
      • Analysis
    • Review parsed artifact and log data for data collected in Scenario 1
    • Examine Windows Event logs, Sysmon data, artifacts of program execution, registry hive files, and more
    • Follow the threat actors' actions from initial infection vector through encryptor payload deployment and execution
    • Identify the tools, scripts, tactics, and processes used throughout each major phase of each attack campaign
      • Answer the questions every organization needs to know following a ransomware event, such as:
    • How did the actors get into the network?
    • What data, if any, were the actors able to access?
    • Were the actors able to exfiltrate any data?
    • Which systems were impacted by the overall campaign, including the encryption payload itself?
    • And more!

Prerequisites

A background in Incident Response (IR) is suggested. This course is aimed toward the incident responder who needs to respond to ransomware attacks. Thus, IR experience or at least alert triage experience such as one acquired within a SOC or CIRT is recommended. Additional recommended experience includes Windows artifact identification and analysis, such as one learns in FOR500: Windows Forensic Analysis. Finally, we recommend familiarity with regular expressions (regex) along with general SIEM use.

All these items are covered in the course, but the general idea is to have experience working incidents.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MANDATORY FOR528 SYSTEM HARDWARE REQUIREMENTS
  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple systems using the M-based (M1/M2/M3) processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 16GB of RAM or more is required.
  • 200GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
MANDATORY FOR528 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org

Author Statement

"Ransomware and cyber extortion have become ubiquitous. No matter how much we organize to rid the world of the ransomware scourge, we find that ransomware only becomes more common, threat actors become increasingly bold, and organizations continue to buckle under the pressure of these attacks. Luckily for us, the primary methods by which ransomware actors succeed in their attacks involve general failures in 'Security 101' practices. If we work together, these can be fixed! Until then, we as security practitioners need to know how to respond to these threats. You and your organization need to know what to collect, how to collect it, how to parse that data, and how to analyze that data in a quick and efficient manner. Such is the focus and goal of our course."

-Ryan Chapman

Register for FOR528

Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.

Loading...