- Видео 961
- Просмотров 4 297 025
SANS Digital Forensics and Incident Response
США
Добавлен 7 дек 2011
Over 80% of all breach victims learn of a compromise from third-party notifications, not from internal security teams. In most cases, adversaries have been rummaging through your network undetected for months or even years.
Incident response tactics and procedures have evolved rapidly over the past several years. Data breaches and intrusions are growing more complex. Adversaries are no longer compromising one or two systems in your enterprise; they are compromising hundreds. Your team can no longer afford antiquated incident response techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident.
A thorough understanding of many detailed areas is required for success, including a mastery of the following fundamental skills covered by the SANS Digital Forensics and Incident Response (DFIR) RUclips Channel.
Incident response tactics and procedures have evolved rapidly over the past several years. Data breaches and intrusions are growing more complex. Adversaries are no longer compromising one or two systems in your enterprise; they are compromising hundreds. Your team can no longer afford antiquated incident response techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident.
A thorough understanding of many detailed areas is required for success, including a mastery of the following fundamental skills covered by the SANS Digital Forensics and Incident Response (DFIR) RUclips Channel.
Panel | Going Dark: DOS’ing Yourself for the Better
SANS Ransomware Summit 2024
Panel | Going Dark: DOS’ing Yourself for the Better
Ryan Chapman, Certified Instructor, SANS Institute
Stephanie Regan, Principal Cybersecurity Incident Response Consultant, Unit 42 by Palo Alto Networks
Michael Rogers, Senior Director Technical Advisory Services, MOXFIVE
Jim Walter, Senior Threat Researcher, SentinelLabs, SentinelOne
Aaron Walton, Threat Intel Analyst, ExpelJohn Hammond, Research & Development Threat Operations, Huntress
This panel discussion is designed to equip attendees with effective strategies for ransomware defense while emphasizing the importance of mastering the basics.
Commencing with the crucial role of employee education, the session guides...
Panel | Going Dark: DOS’ing Yourself for the Better
Ryan Chapman, Certified Instructor, SANS Institute
Stephanie Regan, Principal Cybersecurity Incident Response Consultant, Unit 42 by Palo Alto Networks
Michael Rogers, Senior Director Technical Advisory Services, MOXFIVE
Jim Walter, Senior Threat Researcher, SentinelLabs, SentinelOne
Aaron Walton, Threat Intel Analyst, ExpelJohn Hammond, Research & Development Threat Operations, Huntress
This panel discussion is designed to equip attendees with effective strategies for ransomware defense while emphasizing the importance of mastering the basics.
Commencing with the crucial role of employee education, the session guides...
Просмотров: 180
Видео
Atomic Ransomware Emulation
Просмотров 2107 часов назад
Being able to replicate ransomware TTPs is a critical component of a security operations continual training program. Often, access to tools to emulate these TTPs are not readily available, and the time necessary to deploy can eat up what little training time the team has. In this presentation, Gerard will walk attendees through leveraging the open-source threat emulation tool Atomic Red Team to...
Keynote | Behind the Screens: Decrypting the Ransomware Diaries
Просмотров 2317 часов назад
In this talk, I will discuss the process behind creating the Ransomware Diaries. I will share the methods and strategies I use in my research, which often involve encounters with criminals. Expect to hear previously undisclosed details about my adventures! Additionally, I'll outline how to build trust with threat actors and how to use the information obtained, including falsehoods, in combinati...
Ransomware Data Leak Sites: The Uncomfortable Truths
Просмотров 1187 часов назад
Openly available ‘data leak sites’ are standard operating procedures for modern ransomware/extortion threat actors. Hosting huge swaths of accessible and searchable data brings about many uncomfortable challenges. This includes organizations (or employees within) being exposed possessing illicit (unlawful) data and imagery. Downstream customer data is frequently compromised in the case of IAM t...
Strategies for Active Defense against Pre-Ransomware and Ransomware Attacks
Просмотров 1407 часов назад
SANS Ransomware Summit 2024 Defending Against the Cyber Siege: Strategies for Active Defense against Pre-Ransomware and Ransomware Attacks Syed Zaidi, Senior Incident Response Analyst, Sophos As the threat landscape continues to evolve, organizations face an ever-growing risk of falling victim to ransomware attacks. These malicious attacks not only jeopardize sensitive data but also threaten bu...
Evolution of Ransomware Tactics in 2023: Insights from The DFIR Report
Просмотров 2647 часов назад
Ransomware goals and objectives have largely remained unchanged, but the underpinning tradecraft has been evolving to counter defensive measures. Throughout 2023, The DFIR Report investigated and analyzed numerous ransomware attacks, uncovering a wealth of valuable insights. In this presentation, we delve into the intriguing tools and techniques that emerged over the past year, from access, lat...
Ransomware Running Wild in the Cloud
Просмотров 1757 часов назад
Threat actors evolved their methods conducting ransomware attacks in the cloud and on-premise during 2023 and show no signs of stopping. This discussion addresses initial access factors and threat actor trends associated with cloud ransomware attacks, including a shift to server-side exploits and prioritization of data exfiltration over data encryption. Content also includes notable incidents, ...
Unmasking Cyber Shadows: A Tactical Approach to Hunting Ransomware TTPs
Просмотров 1907 часов назад
2023 was another record breaking year for ransomware. We saw many notable attacks this year. The ransomware attack on the City of Dallas in May orchestrated by the Royal ransomware group led to shutdown and disruption of many services in the city and data exfiltration that impacted approximately 26000 people. The MOVEit exploitation by Cl0p in May turned out to be the biggest cyberattack story ...
Rob T. Lee - Federal officials warn of attacks on water utilities
Просмотров 692Месяц назад
Hacker groups from Russia, China, and Iran have taken credit for recent water utility hacks, and the federal government has urged even smaller communities to take action. CBS 2's Charlie De Mar reports.
FOR585: Smartphone Forensic Analysis In-Depth course overview
Просмотров 1,1 тыс.2 месяца назад
To learn more visit www.sans.org/FOR585 FOR585: Smartphone Forensic Analysis In-Depth course provides examiners and investigators with advanced skills to detect, decode, decrypt, and correctly interpret evidence recovered from mobile devices. The course is continuously updated to keep up with the latest file formats, malware, smartphone operating systems, third-party applications, acquisition s...
FOR578: Cyber Threat Intelligence Course Overview
Просмотров 1,7 тыс.3 месяца назад
Learn more about the course at: sans.org/FOR578 Cyber threat intelligence represents a force multiplier for organizations looking to update their response and detection programs to deal with increasingly sophisticated advanced persistent threats. Malware is an adversary's tool but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent...
Why take FOR578 OnDemand? with Robert M. Lee
Просмотров 5523 месяца назад
-OnDemand cyber security courses from SANS Institute gives you anytime, anywhere access to world leading cybersecurity training. -More than 60 of SANS most popular courses are available via OnDemand, and all are taught by SANS top instructors. -OnDemand courses include the same hands-on labs and exercises used in our instructor led classes while also offering SME support to answer your specific...
Rob T. Lee - Could LockBit, ransomware provider have been behind Lurie hack?
Просмотров 8473 месяца назад
In what could be a major development in the cyberattack against Lurie Children's Hospital, the FBI and British authorities have taken down what they call the world's most prolific ransomware group. There is speculation that the group, LockBit, could also be behind the attack and serious outage at the hospital that began back on Jan. 31. The group's involvement has not been confirmed, but LockBi...
Rob T. Lee Chicago's Lurie Children's Hospital RANSOMWARE ATTACK
Просмотров 2883 месяца назад
CHICAGO (CBS) - Chicago's Lurie Children's Hospital confirmed for the first time on Thursday it experienced a cyberattack from an outside threat, which led the hospital to take its phone, email, and other systems offline on Jan. 31 and caused disruptions to its regular operations since then. In a statement, hospital officials said their network was accessed by a "known criminal threat actor," a...
FOR589: Cybercrime Intelligence Overview
Просмотров 1,5 тыс.3 месяца назад
FOR589: Cybercrime Intelligence Overview
FOR528: Ransomware & Cyber Extortion Course Overview
Просмотров 7974 месяца назад
FOR528: Ransomware & Cyber Extortion Course Overview
Thinking DFIRently From Entry to Specialty
Просмотров 2,5 тыс.4 месяца назад
Thinking DFIRently From Entry to Specialty
How to Leverage Cloud Threat Intelligence Without Drowning: The Zero-Noise Approach
Просмотров 7014 месяца назад
How to Leverage Cloud Threat Intelligence Without Drowning: The Zero-Noise Approach
Beyond the Basics: The Role of LLM in Modern Threat Intelligence
Просмотров 2,3 тыс.4 месяца назад
Beyond the Basics: The Role of LLM in Modern Threat Intelligence
Applying Threat Intelligence Practically to Meet the Needs of an Evolving Regulatory Environment
Просмотров 4294 месяца назад
Applying Threat Intelligence Practically to Meet the Needs of an Evolving Regulatory Environment
How an Info Sharing Analysis Center Works w/ its Members to Improve Cyber Defenses for Their Sector
Просмотров 3084 месяца назад
How an Info Sharing Analysis Center Works w/ its Members to Improve Cyber Defenses for Their Sector
Bridging the Intelligence Divide: Building CTI Blueprints for Value-Based Production
Просмотров 3474 месяца назад
Bridging the Intelligence Divide: Building CTI Blueprints for Value-Based Production
How Threat Intelligence Helped Us Defend and Respond to a Nation-State-Sponsored Threat Actor
Просмотров 5174 месяца назад
How Threat Intelligence Helped Us Defend and Respond to a Nation-State-Sponsored Threat Actor
Clustering Attacker Behavior: Connecting the Dots in the RaaS Ecosystem
Просмотров 1,4 тыс.4 месяца назад
Clustering Attacker Behavior: Connecting the Dots in the RaaS Ecosystem
Threat Intelligence is a Fallacy, but I May be Biased
Просмотров 8114 месяца назад
Threat Intelligence is a Fallacy, but I May be Biased
Deep Dive into Supply Chain Compromise: Hospitality’s Hidden Risks
Просмотров 1974 месяца назад
Deep Dive into Supply Chain Compromise: Hospitality’s Hidden Risks
Beyond Cryptojacking: Studying Contemporary Malware in the Cloud
Просмотров 1964 месяца назад
Beyond Cryptojacking: Studying Contemporary Malware in the Cloud
Why Won’t They Listen? - ConnectingYour CTI to Decision Makers
Просмотров 2504 месяца назад
Why Won’t They Listen? - ConnectingYour CTI to Decision Makers
Cybersecurity is GeoPolitical: Lessons From the Fight Against Mercenary Spyware Proliferation
Просмотров 8274 месяца назад
Cybersecurity is GeoPolitical: Lessons From the Fight Against Mercenary Spyware Proliferation
Intellimation: Guidance for Integrating Automation in Your Cyber Threat Intelligence Program
Просмотров 3374 месяца назад
Intellimation: Guidance for Integrating Automation in Your Cyber Threat Intelligence Program
thanks mehmet, great info that's hard to find!
where can i find this write block file
While there are some good nuggets. She generally starts a point then allows to hang unfinished. She says to ignore trends yet relies on causality. The nuance of these ideas is lost. Great topic, poor presentation.
Awesome
Awesome
Did he trying to scrap the content from bleeping computers and other sources. If so, is it allowed to scrap the content from those sites.
Ian sold himself out to law enforcement, people know you write 2 versions of your software Ian
Thank you for taking the time to do this! Super helpful
Super 🎉🎉🎉
❤🎉
Sounds like an interesting course for the future. Something to aim for in due course.
Great video, i watched prolly about 30-40 lectues from you guys at sans
Lame unprofessional you're not intellect enough to attach ppt... please do
nice
watch out for shim and wal files is all i will say 🤓😎
wonderful course my fav part is anti forensics
course has stuff alot of others dont talk about, or if I am not wrong dont even know about !!
great course pal
Why would they not hit the critical infrastructure with a cyberattack if we do nothing about it, I'll never understand that logic.
That’s fucking interesting, man
This is nothing new
Very true, it's good that it's turning up on the news again but at the same time, things like this just shouldn't be occurring with the coverage they have had in the past, or at least should be minimal. It is difficult to see that seemingly issues just aren't being sorted as priority for CNI.
great course
Awesome speaker, learned a lot and laughed my butt off quite a few times 😂😂
Very neat explanation
Thank you *arcquirky* your sense of humor is top notch and working with a great team like yours make recovering of stolen funds easy and straightforward i cant believe i got my crypto funds back reach out to them on there info today
On Instagram
On insta
Thank you *arcquirky* your sense of humor is top notch and working with a great team like yours make recovering of stolen funds easy and straightforward i cant believe i got my crypto funds back reach out to them on there info today
Tremendous work... great info and entertaining! Thanks!
Just watched the talk on email alterations at the DFIR Summit. Damn, guys, you seriously need to take a look at FilterBounce. It is changing the game in email verification, making everything else look like child is play in comparison.
I have been tuning into SANS Digital for a while now, never disappoints! Quick suggestion, how about a vid showcasing FilterBounce is capabilities? It is an email verifier tool that still keeps my bounce rate under 1%, even when others miserably fail!
Just caught your fantastic Forensic Investigation talk. Ever given FilterBounce a shot? It is like having an ace up your sleeve for email verification and lead generation, plus their api is perfect for contact form verification. Changed the game for me! Keep up the great work, SANS!
Your segment on email investigations got me thinking. There is this tool, FilterBounce, it is the best solution for spotting nifty email ID is that other services label as risky! It revolutionizes lead gen.
I lol'd a bit too much at Friday night's w/ Windows registry
Where can we download the PPT?
Hi, I believe that I am a victim of a crypto scam and I am not to withdraw my funds unless I pay a large tax first. Is it possible to unlock the account and withdraw the money ?
Hello don't send them any other money they are scammers I was a victim too so I know how they keep asking for more money
Thank you *arcquirky* your sense of humor is top notch and working with a great team like yours make recovering of stolen funds easy and straightforward i cant believe i got my crypto funds back reach out to them on there info today
On Instagram
On insta
They are very reliable and professionals I strongly recommend them
Thanks for the sharing!
Always enjoy ryan's talks. Full of knowledge.
You gave me hope. Thank you! Also, you are one of the best presenters I’ve ever seen in this field. Clear, upbeat and interesting.
Kevin is wonderful. I could listen to him lecture all day.
Question: after you create the symbolic link, the contents of the user directory for the user "Donald" is still not browsable in Windows Explorer due to Windows detecting the existing user rights, correct ? (age old problem where you do not have permission to the c:\users\donald directory)
Great talk!
@SANS will there be a kinda SEC6XX or SEC7XX focussed on Smartphone pentesting. Potentially in a similar fashion as OffSec has for OSCE³ but on Mobile Devices ? Digging deeper into zero click exploits
Keeps stretching and stretching takes forever to get to any meat.
Sounds like the speaker is dialed in on a cell phone. Use VOIP next time so you're clear and easy to understand please.
great stuff
Absolutely Fantastic !! Learnt a lot.
I can't imagine how hard it would be to decide to take on a moneygetback role of scammed person, The history need to be remembered though and the help that was born through such pain and suffering. Mad respect to these Adriannotch
I can't imagine how hard it would be to decide to take on a moneygetback role of scammed person, The history need to be remembered though and the help that was born through such pain and suffering. Mad respect to these Adriannotch
The efficiency of this is next level. To juggle walk throughs of various angles on the topic delivered to-camera, differnet content per topic from various folk underneath the umbrella of the track list of the larger big band concert itself is engaging and refined. To make a dense taccess like this SO digestible is really something. Awesome works ADRIANNOTCH !
The efficiency of this is next level. To juggle walk throughs of various angles on the topic delivered to-camera, differnet content per topic from various folk underneath the umbrella of the track list of the larger big band concert itself is engaging and refined. To make a dense taccess like this SO digestible is really something. Awesome works ADRIANNOTCH !
This Adriannotch on the internet is stuck in my brain and it is very beautiful. I listen to their advice every day. It is one of my favorite recovery agent and I loved it very much. Thank you to those who performed it. Long live, especially from Iraq.