Abstract

This class is organized and designed to introduce students to valuable techniques that are used to understand, detect, defend and analyze practical scenaries that are infected by ransomware.

We will present details about incident response and threat hunting of systems infected by ransomware, where different concepts and techniques will be taught such as basic defense measures, detection and commands that can be executed to collect relevant information from a compromised machine. As expected for a practical class, we will acquire evidence and artifacts that will be useful for our analysis through approaches from digital forensics, incident response and threat hunting point of view. As the main goal, we will study all gathered information to gain a better understanding of the origin, vectors, methods, persistence, network communication and consequences of the attack.

This class is focused on x86/x64 Windows.

Who Should Attend

This class should be attended by professionals and students interested in learning how to manage ransomware scenarios as well as people interested in improving their skills with concepts and techniques that are used for defending, detecting and analyzing such practical cases.

Key Learning Objectives

Students attending this class will:

  • Learn fundamental commands and tools used to collect information.
  • Understand detection and countermeasures used for ransomware attack scenarios.
  • Get a basic knowlege about cryptography and a quick overview about how a real code of a ransomware works.
  • Learn how to perform first static and dynamic analysis.
  • Learn how to collect threat hunting information.
  • Learn methods to evidence acquisition.
  • Understand possible procedures during an incident response session.
  • Learn effective methods to perform practical investigations.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Attendees should be prepared to work and install programs on Windows environments.
  • Students should be ready to use multiple operating system commands.
  • Students should have a good foundation on cyber security concepts.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running Windows 11 x64.
  • Malwoverview installed on all virtual machines, including all necessary APIs already configured.
  • Visual Studio Code installed on both Windows virtual machines.
  • IDA Pro or Free might be useful.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Lab Setup
  • Introduction
  • Evidence collection: tools, command line and PowerShell
  • Countermeasures and Detection
  • Cryptography Review
  • Practical Investigation

Note: Topics can be added, merged or removed without prior notice!