FOR528: Ransomware and Cyber Extortion

Overview

The Ransomware and Cyber Extortion course begins with a review of ransomware history. We begin with the story of the first-known ransomware attack and work our way to the current-day threats that loom over our industry. Our inner-connected lives, not to mention livelihoods, are at risk everyday thanks to the advent of HumOR and RaaS. You will increase your understanding of ransomware as we deep-dive into the roles, processes, communication methods, and activities related to these threats.

We then cover preparation strategies along with what to do if you are about to be encrypted, are currently being encrypted, or are just recently encrypted. We cover the actions you need to take including the entities you need to contact, the departments you need to involve, and the processes you need to put in place with special attention to temporal requirements. The clock is ticking!

After learning about the true threats, we face and how we can apply incident response practices in general, we begin our deep-dive into the Windows-based forensic artifacts best suited to ransomware campaign analysis. You’ll learn which artifacts to collect along with which tools and methods are best suited to acquisition and parsing. Regardless of your organization’s level of preparedness, we’ll cover what you can do to obtain data that will facilitate analysis.

You’ll learn the hands-on approaches for direct acquisition against single machines and then transition to acquisition and analysis at-scale. Detailed hands-on labs walk you through analysis methods for each environment type. You’ll use TimeSketch to analyze parsed artifacts, ensuring that you recognize the easy wins and more advanced analysis practices to help you and your organization respond to the ransomware threat.

Full Lab Details

• Install the customized FOR528 Windows and SIFT virtual machines (VMs), configuring them as required for detailed log review and malware analysis.
• Lab 1.1: Utilize a ransomware "builder" to generate a customized ransomware encryptor payload along with a decryption tool. You will run the ransomware payload you generate, review the encrypted files, and then use the decryption tool to decrypt the data.
• Lab 1.2: Review forensic artifacts collected from a compromised environment and then parse the data using the Kroll Artifact Parser and Extractor (KAPE). Utilize Timeline Explorer to review data parsed via KAPE while focusing on Master File Table (MFT), SRUM, Shellbags, Shimcache, and Windows Event Log artifacts.
• Lab 1.3: Hunt data within the TimeSketch interface while focusing on how analysis of MFT, SRUM, Shellbags, Shimcache, and Windows Event Log scales when moving from the previous lab's manual analysis to at-scale analysis.

Full Topic Details

• Course VMs
• Overview and setup
• Custom Attack Scenarios Overview - Labs and CTF are based on these attacks:
• "Samaran Protect" victim environment attacked in two different scenarios
• Scenario 1: "BlueLocker" ransomware group
• Victim network modeled after a default, low visibility Windows environment
• Scenario 2: "Balrog" ransomware group
• Victim network modeled with higher visibility (e.g. EDR-like telemetry in place) to represent a better-tooled environment
• Ransomware Evolution and History
• The world’s first recognized ransomware attack
• Fully automated ransomware: Lockers and single-machine encryption payloads
• The advent of Human Operated Ransomware (HumOR)
• Ransomware-as-a-Service (RaaS)
• RaaS model, hierarchies, and roles
• RaaS builders and generators
• RaaS dashboards
• Ransomware Operators
• Group evolution over time
• Types of extortion
• Data leak sites and psychological pressures
• Darkweb forum communications
• Victim access: selling vs. Buying
• Affiliate programs
• Incident Response for Ransomware
• The tried-and-true Prepare, Identify, Contain, Eradicate, Recover, and Lessons Learned (PICERL) model
• The new Dynamic Approach to Incident Response (DAIR) model
• Phases of a typical ransomware attack campaign end-to-end
• AI in Ransomware
• First signs of active AI use
• Phishing and social engineering using AI
• The world’s first AI-powered ransomware
• First proof of actual AI use for an end-to-end ransomware campaign
• AI defender tool example: the “AI-Powered Ransomware Intelligence Agent”
• Dealing with an Active Threat
• Time considerations
• Informed consent
• Departments and roles that need to be involved
• Understanding ransom notes
• Scoping considerations (what needs to be known/collected)
• Securing critical services and functions
• "Going dark" - a.k.a. cutting Internet connectivity
• What you need to do now vs. later
• Ransomware Payments
• Cons regarding payment
• Pros regarding payment
• Threat actor communications and negotiations tips
• Forensic Artifact Collection
• Forensics artifacts that pertain the most to ransomware and cyber extortion analysis
• Forensic artifact collection
• Process/parse collected artifacts using KAPE
• Review the output of parsed artifacts to better understand the tools and methodologies leveraged to parse the forensic data for review
• Analysis at Scale
• Using Velociraptor to collect in bulk
• Log augmentation to enhance visibility
• Logs and log artifacts to collect
• Log aggregators/SIEMs and field schemas
• Analysis at-scale via TimeSketch

Overview

Ransomware incidents are not especially unique. We incident responders see the same tactics, techniques, and procedures (TTPs) over and over... So, let's learn how to detect them!

Section 2 begins with a hands-on lab for Kibana, a secondary log aggregation graphical user interface useful for facilitating ransomware and cyber extortion investigations. We then transition from artifact analysis to covering the initial stages of a ransomware campaign attack cycle. We begin by covering Initial Access, Execution, Defense Evasion, and scripting engine abuse. Most ransomware cases involve actors leveraging scripting engines such as PowerShell, Batch scripts, JavaScript, Visual Basic Scripting, and more.

We move to discussing the various tools and scripts that we see time and again, providing an overview of each tool along with details for hunting and detection. This leads into our module on persistence. You'll learn about common post-exploitation frameworks, C2 mechanisms, RMM solutions, and native Windows methods ransomware operators use to maintain access to an environment.

We then pivot an in-depth review of Cobalt Strike (CS), an adversary emulation and attack simulation tool that has become perhaps "too" good at its job.

Much of our training is punctuated with hands-on labs that walk you through analysis methods step-by-step. We aim to ensure that both those with experience and those newer to the realm of incident response can work a ransomware or cyber extortion incident from beginning to end.

Full Lab Details

• Lab 2.1: Learn the ins-and-outs of the most common interface associated with Elasticsearch, Logstash, and Kibana (ELK) stacks while adapting skills acquired in previous labs.
• Lab 2.2: Identify successful phishing attacks via hunting Microsoft Office applications as parent processes, zip files opened natively in Windows, zip file credential read operations, Outlook downloading/executing files, and review of the Microsoft Trust Center.
• Lab 2.3: Learn to analyze encoded and obfuscated PowerShell payloads.
• Lab 2.4: Decode and analyze Cobalt Strike payloads including PowerShell shellcode injectors and "stageless" beacon EXE and DLL loaders.
• BONUS Lab 2.5: Hunt malicious RDP activity to identify initial infection vectors along with internal lateral movement.

Full Topic Details

• Analysis At-Scale via Kibana
• The Phases of a Ransomware Attack Campaign Covered in Section 2:
• Initial access
• Execution
• Defense evasion
• Persistence

The following sections include in-depth details on the tools, processes, and methods for detection and hunting.

• Initial Access
• Clickfix prevention, detection, and hunting
• MS Teams-based initial access prevention, detection, and hunting
• Top 3 initial access methods: Remote access, social engineering, and software vulnerabilities
• Phishing topics include:
• Malware infections vs. credential harvesting
• Attacker-in-the-Middle frameworks
• Malicious attachments such as MalDocs
• Recommended Email Gateway File Block List
• Malicious links and how to analyze them
• Remote Desktop Protocol (RDP) for Initial Access
• Reasons RDP is a threat
• Useful Windows Event Logs for RDP analysis
• Identifying malicious RDP activity
• Software Vulnerabilities topics include:
• Zero-day vs. Common Vulnerabilities and Exposures (CVEs)
• Example CVEs targeted and exploited in the wild
• Identifying software exploitation through contextual analysis
• Threat Actor Tooling & Execution
• Bring Your Own Tools (BYOT)
• The Ransomware Tool Matrix project
• Native Execution Methods – e.g. Top 10 LOLBINs leveraged
• Defense Evasion
• Common bypass tooling
• EDR killers and silencers
• LOLBAS methods for evasion
• Prevention and Detection for Windows Management Instrumentation (WMI) attacks
• Scripting engine abuse
• PowerShell script logging and analysis
• Batch scripts
• JavaScript scripts
• Visual Basic Scripting
• PowerShell logging and advanced analysis
• Persistence
• Common C2 methods
• Remote Monitoring and Management (RMM) tools
• Post-exploit frameworks
• Account creation
• Boot/logon auto-start locations
• Service installations
• Scheduled tasks
• WMI event subscriptions
• Cobalt Strike (CS)
• Threat actor access and utilization
• CS architecture and components
• Commands and cheat sheets
• Detection methods
• Payload decoding tools and methods

Overview

Section 3 begins with Privilege Escalation, Credential Access, and Lateral Movement. What tools do ransomware actors use to escalate privileges on machines? How do they access stored credentials from Windows hosts? What processes are often dumped, why, and how? For lateral movement, you'll learn about how RDP, SMB, WinRM, and other methods are used to move throughout the victim network.

We then turn our attention to attacks against Microsoft's Active Directory (AD). Ransomware operators love to attack AD, so we'll break down the various ways in which they take advantage of poor AD configurations to escalate privileges and access credentials. You’ll learn about AD enumeration along with Kerberoasting, AS-REP Roasting, and DCSync attacks, including how the attacks work along with how to prevent and detect these attacks.

We continue the attack lifecycle with one of the more critical sections of the course - Data Access and Data Exfiltration. Organizations usually want to know what data may have been accessed and/or stolen. This is especially when the legal and executive teams enter the picture. We cover data archival and staging methods, including ways to hunt the tools that facilitate these activities. Would you believe that FTP and SFTP are common exfiltration routes? How can you best detect data being exfiltrated even if you don't know what data is being exfiltrated? How can you prevent data exfiltration before it happens? We'll show you!

We then move to the final phase of the ransomware attack, payload deployment, and the inner workings of encryption. You'll learn about backup and recovery tampering along with the methods by which ransomware actors attack backup systems. The ways in which actors cover their tracks might seem obvious, but some of them are quite sneaky! We end this section with technical details pertaining to the most common payload deployment methods.

Finally, we cover hunting methods such as identifying renamed executables, malicious files/processes via analysis of directories commonly used by ransomware actors, and more. This is where we show you the best ways to keep an eye on your organization.

Full Lab Details

• Lab 3.1: Identify lateral movement via mechanisms such as RDP and PsExec.
• Lab 3.2: Hunt and identify data access and potential exfiltration via hunting and pivoting through parsing and analyzing NTFS metadata (NTFS, UsnJrnl, etc.) and using analysis tools including Timeline Explorer, TimeSketch, and Kibana.
• Lab 3.3: Detecting the threat actor's toolbox via hunting methods such as detecting renamed tools, focusing on common staging directories, and more.
• BONUS Lab 3.4: Identify additional lateral movement via means such as WMI, Cobalt Strike, and more.

Full Topic Details

• The Phases of a Ransomware Attack Campaign Covered in Section 3:
• Privilege escalation
• Credential access
• Lateral movement
• Attacks against AD
• Data access
• Data exfiltration
• Payload deployment
• Privilege Escalation and Credential Access
• Commonly targeted accounts
• Methods by which accounts are targeted
• User Account Control (UAC) bypass methods
• Local Security Authority Server Service (LSASS) access and dumping
• Attacks on NTDS.dit
• Alternate credentials attacks
• Attacks on passwords stored in browsers and password management tools
• Session sniffers and extractors
• Commonly seen all-in-one solutions (e.g., WinPwn)
• Lateral Movement
• RDP and RDP cached bitmap analysis
• Server Message Block (SMB) lateral movement
• Named pipe utilization and relation to service installs
• SysInternals PsExec
• Windows Remote Management (WinRM)
• Attacks against ESXi + Prevention tips and tricks
• AD Attacks
• AD enumeration
• Bloodhound and SharpHound
• Kerberoasting
• AS-REP roasting
• DCSync attacks
• Golden ticket attacks
• Data Access
• Reporting and legal considerations
• Network share enumeration and access
• Deleted file and file knowledge
• File and folder access
• Registry analysis
• Tool-specific analysis
• Data Exfiltration
• Archive creation
• Data staging
• Creation/use of .txt and .csv files
• Data exfiltration routes
• Network log and NetFlow review
• Backup and Recovery Tampering
• Volume Shadow service attacks
• Boot configuration data, Windows boot status policy, and Windows backup attacks
• Event log clearing
• Payload Deployment
• Common deployment tools and methods
• Deployment via PsExec
• Deployment via Windows Management Instrumentation Command-line (WMIC)
• Deployment via Background Intelligent Transfer Service (BITS)
• Encryption and Decryptors
• Encryption key types
• Overwrite vs. copy/delete encryption methods
• Ransom notes
• Encryption mechanism source code review
• Decryptors
• Hunting Ransomware Operators - Techniques to Identify
• Malicious RDP connectivity
• Process name and path anomalies
• Rogue/malicious executables
• PowerShell encoded commands
• Malicious activity in antivirus logs
• Malicious activity involving environment variables

Overview

Nothing prepares you to respond to ransomware incidents like realistic investigation experience. Since you do not want to gain that experience during a real crisis inside your organization, FOR528 includes an extended-access CTF challenge in which you will analyze a ransomware incident from the infection vector through payload deployment and encryption activity. The scenario is built around Samaran Protect, a realistic victim organization designed to mirror environments students may encounter in the field.

The CTF challenge uses a specially crafted attack scenario against the victim organization. Students work through parsed forensic artifacts and log data to answer the same questions organizations must answer during real ransomware and cyber extortion incidents.

Full Lab Details

• Extended-access analysis of parsed forensic artifacts and logs in realistic scenarios to answer questions common in every ransomware incident.
• Utilizes SANS' ranges.io platform

Full Topic Details

• Extended-Access Digital Forensics Capture-the-Flag Event
• Review parsed artifact and log data for data collected in Scenario 1
• Examine Windows Event logs, Sysmon data, artifacts of program execution, registry hive files, and more
• Follow the threat actors' actions from initial infection vector through encryptor payload deployment and execution
• Identify the tools, scripts, tactics, and processes used throughout each major phase of each attack campaign
• Answer the questions every organization needs to know following a ransomware event, such as:
• How did the actors get into the network?
• What data, if any, were the actors able to access?
• Were the actors able to exfiltrate any data?
• Which systems were impacted by the overall campaign, including the encryption payload itself?
• And more!