FOR528: Ransomware for Incident Responders

  • Online
24 CPEs

FOR528: Ransomware for Incident Responders provides the hands-on training required for those who may need to respond to ransomware incidents. The term "Ransomware" no longer refers to a simple encryptor that locks down resources. The advent of Human-Operated Ransomware (HumOR) along with the evolution of Ransomware-as-a-Service (RaaS) have created an entire ecosystem that thrives on hands-on the keyboard, well-planned attack campaigns. Our course uses deftly devised, real-world attacks and their subsequent forensic artifacts to provide you, the analyst, with all that you need to respond when the threat become a reality.

What You Will Learn

Learning to thwart the threat of human-operated ransomware once and for all!

Ransomware has become a common occurrence about which we hear in our daily computing lives. The threat of ransomware has evolved over time from being a single machine infection following an ill-advised mouse click to becoming a booming enterprise capable of crippling even large and small networks alike. FOR528 teaches students how to deal with the specifics of ransomware to prepare for, detect, hunt, response to, and deal with the aftermath of ransomware. The class includes multiple hunting methods, a hands-on approach to learning using real-world data, and a full-day, hands-on course capstone to help students solidify their learning.

Ransomware campaigns now follow the Tactics, Techniques, and Procedures (TTPs) of larger-scale, hands-on-the-keyboard attacks. This course shows you what artifacts to collect, how to collect them, how to scale out your collection efforts, how to parse the data, and how to review the parsed results in aggregate. The course also provides in-depth details along with detection methods for each phase of the ransomware attack lifecycle. These phases include Initial Access, Execution, Defense Evasion, Persistence, Privilege Escalation, Credential Access, Lateral Movement, Attacks on Active Directory, Data Access, and Data Exfiltration.

The FOR528 Ransomware for Incident Responders In-Depth Course will help you understand:

  • How ransomware has evolved to become a major business
  • How human-operated ransomware (HumOR) operators have evolved into well-tuned attack teams
  • Who and what verticals are most at risk of becoming a ransomware victim
  • How ransomware operators get into their "victim's" environments
  • How best to prepare your organization against the threat of HumOR
  • How to identify the tools that HumOR operators often use to get into and perform post-exploitation activities during a ransomware attack
  • How to hunt for ransomware operators within your network
  • How to respond when ransomware is running actively within your environment
  • What steps to take following a ransomware attack
  • How to identify data exfiltration

Syllabus (24 CPEs)

Download PDF
  • Overview

    The Ransomware for Incident Responders course begins with a review of ransomeware's history. We begin with the story of the first-known ransomware attack and work our way to the current-day threats that loom above our industry. Our inner-connected lives, not to mention livelihoods, are at risk everyday thanks to the advent of Human Operated Ransomware (HumOR) and Ransomware-as-a-Service (RaaS). You will better your understanding of these threats as we deep-dive into the roles, processes, communication methods, and activities related to these threats. The section then transitions to focus on the Dynamic Approach to Incident Response (DAIR) model and how it relates to ransomware.

    After learning about the true threats we face and how we can apply IR practices in general, we begin our deep-dive into the Windows-based forensic artifacts best suited to ransomware campaign analysis. You'll learn which artifacts to collect along with which tools and methods are best suited to acquisition and parsing. Regardless of your organization's level of preparedness, we'll cover what you can do to obtain data that will facilitate analysis. You'll learn the hands-on approaches for direct acquisition against single machines and then transition to acquisition and analysis at-scale. Detailed hands-on labs walk you through analysis methods for each environment type. You'll use TimeSketch and Kibana to analyze parsed artifacts, ensuring that you recognize the easy wins and more advanced analysis practices to help you and your organization respond to the ransomware threat.

    • Install the customized FOR528 Windows and SIFT VMs, configuring them as required for detailed log review and malware analysis
    • Utilize a ransomware "builder" to generate a customized ransomware encryptor payload along with a decryption tool. You will run the ransomware payload you generate, review the encrypted files, and then use the decryption tool to decrypt the data.
    • Review forensic artifacts collected from a compromised environment and then parse the data using KAPE. Utilize Timeline Explorer to review data parsed via KAPE while focusing on Master File Table (MFT), System Resource Usage Monitor (SRUM), Shellbag, Shimcache, and Windows Event Log artifacts.
    • Hunt data within the TimeSketch interface while focusing on how analysis of MFT, SRUM, Shellbag, Shimcache, and Windows Event Log scales when moving from manual analysis from the previous lab to at-scale analysis
    • Learn the ins-and-outs of Kibana while adapting skills acquired in previous labs to the default, most common interface associated with Elasticsearch, Logstash, and Kibana (ELK) stacks


    Course virtual machines

    • Overview & setup

    Review of our custom target victim and their network

    Custom attack scenarios overview. Our labs and Capstone are based on these atacks

    • "BlueLocker" Ransomware group
    • " Balrog" Ransomware group

    Ransomware evolution and history

    • First-recognize ransomware attack
    • Lockers and single-machine encryption payloads
    • Human-Operated Ransomware (HumOR)

    Ransomware-as-a-Service (RaaS)

    • RaaS model, hierarchies, and roles
    • RaaS builders and generators
    • RaaS dashboards

    Intrusion Access Brokers (IABs)

    • Methods of access
    • Darknet marketplaces
    • Victim access: Selling vs. Buying

    Ransomware operators

    • Group evolution over time
    • Types of extortion
    • Data leak sites and psychological pressures
    • Darkweb forum communications

    Forensic Artifact Collection

    • Review artifacts collected by the Kroll Artifact Parser and Extractor (KAPE)
    • Process/parse collected artifacts using KAPE
    • Review the output of parsed artifacts to understand better the tools and methodologies leveraged to parse the forensic data for review

    Incident Response processes and their application to ransomware

    • Dynamic Approach to Incident Response (DAIR) model
    • Phases of a typical ransomware campaign

    Windows Forensic Artifacts

    • Event Logs, Shellbags, Shimcache, SRUM, and more
    • Review of the SANS "Windows Forensic Analysis" poster
    • Using Timeline Explorer to analyze CSV files output by common parsing tools
    • Artifact collection tools
    • Acquiring forensic artifacts

    Analysis at scale

    • Using Velociraptor to collect in bulk
    • Log augmentation via Sysmon
    • Log auditing review via Log-MD
    • Log aggregators/SIEMs and file names

    Analysis GUIs

    • TimeSketch
    • Kibana

  • Overview

    Ransomware incidents are not especially unique. We Incident Responders see the same Tactics, Techniques, and Procedures (TTPs) over and over& So let's learn how to detect them!

    Day two transitions from foundational knowledge to covering the initial stages of a ransomware campaign attack cycle. We begin by covering Initial Access, Execution, Defense Evasion, and scripting engine abuse. Most ransomware cases involve actors leveraging scripting engines such as PowerShell, Batch scripts, JavaScript, and Visual Basic Scripting, and more. In these early sections of the day, we discuss the various tools and scripts that we see time and time again, providing an overview of each tool along with details for hunting and detection. Next, we move to discussing Persistence. You'll learn about common Command and Control (C2) mechanisms, Remote Monitoring and Management (RMM) solutions, and native Windows methods ransomware operators use to maintain access to an environment.

    We then cover Privilege Escalation, Credential Access, and Lateral Movement. What tools do ransomware actors use to escalate privileges on machines? How do they access stored credentials from Windows hosts? What processes are often dumped, why, and how? For Lateral Movement you'll learn about how RDP, SMB (inc. specifically PsExec), WinRM and other methods are used to move throughout the victim network. Our next section focuses entirely on attacks against Microsoft Acitve Directory (AD). Ransomware operators love to attack AD, so we'll break down the various ways in which they take advantage of poor AD configurations to escalate privileges and access credentials.

    Our final section of the day covers Data Access and Data Exfiltration. This is one of the more critical sections of the course. Organizations always want to know what data may have been accessed and/or stolen. We cover data archival and staging methods, including ways to hunt the tools that facilitate these activities. Would you believe that FTP is a common exfiltration route? We end the day presenting methods for detecting data exfiltration. How can you best detect data being exfiltrated, even if you don't know what data is being exfiltrated? We'll show you!

    • Identify successful phishing attacks via hunting Microsoft Office applications as parent processes, zip files opened natively in Windows, zip file credential read operations, Outlook downloading/executing files, and review of the Microsoft Trust Center
    • Learn to analyze encoded and obfuscated PowerShell payloads
    • Identify lateral movement via mechanisms such as RDP, PsExec, WMI, and Cobalt Strike
    • Hunt and identify data access and potential exfiltration via hunting and pivoting through NTFS metadata (NTFS, UsnJrnl, etc.), manual parsing of acquired artifacts, Timeline Explorer, TimeSketch, and Kibana


    The phases of a ransomware attack campaign

    • Initial Access
    • Execution
    • Defense Evasion
    • Persistence
    • Privilege Escalation
    • Credential Access
    • Attacks against Active Directory
    • Lateral Movement
    • Data Access Exfiltration

    The following sections include in-depth details on the tools and processes noted along with methods for detection and hunting:

    • Initial Access
      • Top 3 IV methods: Phishing, RDP, and Software Vulnerabilities
      • Phishing vectors
        • Infection vs. credential harvesting
        • Malicious attachments such as MalDocs
        • Review of our Email Gateway File Block List (linked)
        • Malicious links and how to analyze them
      • Malware-as-a-Service (MaaS)
      • Remote Desktop Protocol (RDP)
        • Import Windows Event Logs
        • Identifying malicious RDP activity
      • Software exploits / Vulnerabilities
        • Zero-day vs. Common Vulnerabilities and Exposures (CVEs)
        • Example CVEs targeted and exploited in the wild
        • Darknet forum discussions RE: know vulnerabilities
    • Execution and Defense Evasion
      • Threat actor tooling -- The shift to:
        • Free and Open-Source (FOSS)
        • Native scripting engines
        • Living Off the Land Binaries and Scripts (LOLBAS)
        • Commercial tooling for adversary emulation (e.g. Cobalt Strike)
        • Malware-as-a-Service (MaaS)
      • Security service/mechanism bypass methods
      • Native execution methods
      • Windows Management Instrumentation (WMI) attacks
        • Import Windows Event Logs
      • Scripting engine abuse
        • PowerShell
        • Batch scripts
        • JavaScript scripts
        • Visual Basic Scripting
      • PowerShell logging and advanced analysis
        • Windows Event Logs and enabling them
        • PowerShell parameters and their purposes
    • Persistence
      • Common C2 methods
      • Remote Monitoring and Management (RMM)
      • Post-exploit frameworks (e.g. Cobaltstrike, Empire, PowerSploit, etc.)
      • Account creation
      • Boot / Logon auto-start locations
      • Service installations
      • Scheduled tasks
      • WMI event subscriptions
    • Privilege Escalation and Credential Access
    • Commonly targeted accounts
    • Methods by which accounts are targeted
    • User Account Control (UAC) bypass methods
    • Local Security Authority Server Service (LSASS) access and dumping
    • NTDS.dit attacks
    • Alternate credentials attacks
      • Attacks on passwords stored in browsers and password management tools
      • Session sniffers and extractors
      • All-in-one solutions seen commonly (e.g. WinPwn)
    • Lateral Movement
      • RDP and RDP cached bitmap analysis
      • Server Message Block (SMB) lateral movement
      • Named pipe utilization and relation to service installs
      • SysInternals PsExec
      • Windows Remote Management (WinRM)
      • Attacks against ESXi
    • Active Directory (AD) Attacks
      • AD Enumeration
      • Bloodhound & SharpHound
      • Kerberoasting
      • AS-REP Roasting
      • DCSync attacks
      • Golden ticket attacks
    • Data Access
      • Reporting and legal considerations
      • Network share enumeration and access
      • Deleted file and file knowledge
      • File and folder access
      • Registry analysis
      • Tool-specific analysis
    • Data Exfiltration
      • Archive creation
      • Data staging
      • Creation/use of .txt and .csv files
      • Data exfiltration routes
      • Network log and NetFlow review

  • Overview

    Day 3 of our course begins with the most feared topics of a ransomware attack: Ransomware payload deployment and the inner-workings of encryption. You'll learn about backup and recovery tampering along with the methods by which ransomware actors attack backup systems. The ways in which actors cover their tracks might seem obvious, simply because they are! We end this section with technical details pertaining to the most common payload deployment methods.

    We then pivot to an in-depth review of Cobalt Strike (CS), an adversary emulation and attack simulation tool that has become perhaps "too" good at its job. Many security professionals around the world such as penetration testers and red teams rely on CS. Unfortunately, we see this extremely powerful commercial tool in a very high percentage of ransomware attacks. You will learn about the tool's infrastructure, Malleable C2 profiles, and payload detection/deobfuscation methods. This includes a hands-on lab in which you will learn to decode CS payloads.

    The next section covers what to do if you are just about to be encrypted, are currently being encrypted, or were just recently encrypted. We cover the actions you need to take including the entities you need to contact, the departments you need to involve, and the processes you need to put in place with special attention to temporal requirements. The clock is ticking! The days final two sections provide a case study of the Conti ransomware group along with useful hunting techniques. While Conti activity may have recently curtailed, the various leaks we've obtained and analyzed as a community paint a picture of how the group operated. Finally, we cover hunting methods such as identifying renamed executables, malicious files/processes via directory analysis, common attacks via AV log analysis, and more.

    • Decoding and analysis Cobalt Strike payloads including PowerShell shellcode injectors and stageless beacon EXE and DLL loaders
    • Hunting malicious RDP activity to identify initial infection vectors and internal-to-internal lateral movement
    • Detecting the threat actor's toolbox via hunting methods such as detecting PSTools, renamed executables, common directories, and more


    Backup and Recovery tampering

    • Volume Shadow Service attacks
    • Boot Configuration Data, Windows Boot Status Policy, and Windows Backup attacks
    • Event log clearing

    Payload Deployment

    • Common deployment tools and methods
    • Deployment via PsExec
    • Deployment via WMIC
    • Deployment via BITS

    Encryption and Decryptors

    • Encryption key types
    • Overwrite vs. Copy/Delete during encryption
    • Ransom notes
    • Encryption mechanism source code review
    • Decryptors

    Cobalt Strike (CS)

    • Threat actor access and utilization
    • CS architecture and components
    • Malleable C2 profiles
    • Commands and cheat sheets
    • Detection methods
    • Payload decoding tools and methods

    Dealing with an Active Threat

    • Time considerations
    • Informed consent
    • Departments and roles that need to be involved
    • "Going Dark" a.k.a. Cutting Internet connectivity
      • Disconnecting network segments
    • Securing critical services and functions

    Ransomware Payments

    • Cons regarding payment
    • Pros regarding payment
    • Threat actor communications and negotiations

    Conti case study

    • Group evolution and team philosophy
    • "Pentester guide" leak
    • Internal communications leak
    • Lessons learned from leaks

    Hunting Ransomware Operators. Hunting techniques to identify:

    • Malicious RDP connectivity
    • Process name and path anomalies
    • Rogue/malicious executables
    • PowerShell encoded commands
    • Malicious activity in Antivirus logs
    • Malicious activity involving environment variables

  • Overview

    Nothing, and we mean nothing, can prepare you better to respond to ransomware incidents than experience. Since you truly do not want to gain that experience within your organization, we provide a full day Capstone Challenge that will have you analyzing ransomware incidents from the infection vector all the way through the encryption payload running within the environment. We have crafted a victim organization, Samaran Protect, to which you can most likely relate your organization. Our Capstone Challenge consists of over 150 questions pertaining to two specially crafted attack scenarios against our victim organization. Our target victim's network includes 15 hosts with three VLANs:


    A full day of analyzing parsed forensic artifacts and logs to answer questions common in every ransomware incident using two separate scenarios

    Scenario 1: "BlueLocker" Ransomware

    Scenario 2: "Balrog" Ransomware

    • Digital Forensics Capstone
      • Analysis
        • Review parsed artifact and log data for Scenario 1 using TimeSketch
        • Review parsed artifact and log data for Scenario 2 using Kibana
        • Examine Windows Event logs, Sysmon data, artifacts of program execution, registry hive files, and more
        • Follow the threat actor's actions from initial infection vector through encryptor payload deployment and execution
        • Identify the tools, scripts, tactics, and processes used throughout each major phase of each attack campaign
    • Answer the questions every organization wants answered following a ransomware event, such as:
      • How did the actors get into the network?
      • What data, if any, were the actors able to access?
      • Were the actors able to steal (i.e. exfiltrate) any data?
      • Which systems were impacted by the overall campaign, including the encryption payload itself?


A background in Incident Response (IR) is suggested. This course is aimed toward the incident responder who needs to respond to ransomware attacks. Thus, IR experience or at least alert triage experience such as one acquired within a SOC or CIRT is recommended. Additional recommended experience includes Windows artifact identification and analysis, such as one learns in FOR500: Windows Forensic Analysis. Finally, we recommend familiarity with regular expressions (regex) along with general SIEM use.

All these items are covered in the course, but the general idea is to have experience working incidents.

Laptop Requirements


  • A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.
  • You can use any 64-bit version of Windows, Mac OSX, or Linux as your core operating system provided you can install and run VMware virtualization products. Students are provided with a digital forensic lab consisting of two (2) VMware Virtual Machines (VMs). You must have a minimum of 12 gigabytes (GB) of RAM or higher for the class VMs to function, bu t 16 GB of RAM is highly recommended for the best experience.
  • The recommended amount of RAM will facilitate your running both VMs provided with your course:
    • FOR528 Windows VM: 4GB RAM required
    • FOR528 SIFT VM: 8GB RAM recommended
  • It is critical that your CPU and operating system support 64-bit applications so that our 64-bit guest VMs can run on your laptop. VMware provides a free tool for Windows and Linux that will detect whether your host supports 64-bit guest VMs. For further troubleshooting, this article also nstructions for Windows users to determine more about CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
  • Please download and install VMWare Workstation, VMware Fusion , or VMware Player on your system prior to the start of the class. Your version of VMware cannot be more than one version behind the latest available version of the software. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware


  • CPU: 64-bit Intel i5/i7 (4th generation+) x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important: a 64-bit system processor is MANDATORY.)
  • 12 GB of RAM or higher is mandatory for this class (Important - 8 GB of RAM or higher of RAM is mandatory and minimum. For the best experience, 16GB of RAM is recommended.)
    • IMPORTANT: Any device with less than 16GB of RAM may not be able to run both VMs at the same time, which will hamper your analysis efforts and thus your overall learning experience
  • 300 GB host system hard drive size
  • 150 GB minimum of free space on your host hard drive
    • We recommend a minimum of 200 GB of free hard drive space to facilitate taking snapshots of your VMs
  • Students must have Local Administrator access within their host operating system and access to the BIOS settings


  • Host Operating System: Fully patched and updated Windows, Mac OSX (10.10+), or a recent version of the Linux operating system (released 2016 or later) that also can install and run VMware virtualization products (VMware Workstation, VMware Fusion, VMware Player).



  • Bring the proper system hardware (64bit / 12GB+ RAM) and operating system configuration
  • Install VMware (Workstation, Player, or Fusion) and make sure everything works before class.
    • See Lab 0 in your digital workbook along with the provided course ISO for specific details on how to setup your course VMs

Author Statement

"Ransomware has become ubiquitous. No matter how much we organize to rid the world of the ransomware scourge, we find that ransomware only becomes more common, threat actors become increasingly bold, and organizations continue to buckle under the pressure of these attacks. Luckily for us, the primary methods by which ransomware actors succeed in their attacks involve general failures in "Security 101" practices. If we work together, these can be fixed! Until then, we as security practitioners need to know how to respond to these threats. You and your organization need to know what to collect, how, how to parse that data, and how to analyze that data in a quick and efficient manner. Such is the focus on goal of our course. "--Ryan Chapman

Register for FOR528

  • In Person

Training events and topical summits feature presentations and courses in classrooms around the world.

Learn more
  • Live Online

Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

Learn more
  • OnDemand

Study and prepare for GIAC Certification with four months of online access. Includes labs and exercises, and support.

Learn more