Digital Forensics and Incident Response
Explore content featuring this instructor’s insights and expertise.
今回のCommunity Nightでは､SANSの「FOR528: Ransomware for Incident Responders」の開発者であるRyan Chapmanが、ランサムウェアの運用に活用されているツールについて紹介します。ランサムウェアの運用については様々なバリエーションが存在しますが、活用されているツールには重複している点も少なくありません。
Join us in this Community Night talk as Ryan Chapman, author of SANS FOR528: Ransomware for Incident Responders, provides an overview of tools leveraged often by ransomware operators. Though a multitude of ransomware operations and affiliate groups exist, we see a great deal of overlap between the tools leveraged by these groups (and that's an understatement!).
A large majority of ransomware incidents involve both obfuscated scripts and Cobalt Strike. PowerShell reigns supreme as the most common type of obfuscated script found in ransomware cases. Do you know what to do should you find an obfuscated PowerShell script during response? What if you run into an obfuscated, PowerShell-based Cobalt Strike downloader? Do you know how to decode the downloader? Do you know how to review the shellcode found multiple levels within the code structure to determine where the Cobalt Strike beacon is being hosted?
