Hunting Human Operated Ransomware Operators | 2020 Threat Hunting & Incident Response Summit

The real threat of ransomware these days lies in "Human Operated Ransomware" attacks, in which we see the deployment of ransomware move to secondary or tertiary objectives. The human operators often focus on enumerating the internal environment in preparation of data exfiltration. By the time the ransomware is deployed, the threat actors have already carried out their initial objectives (and stolen your data!). This talk focuses on finding these operators while they are in your network. Find the operators == stop the ransomware deployment.
Speaker: Ryan Chapman, @rj_chap, Principal Incident Response Analyst, Blackberry; Instructor, SANS Institute

[@Warlock1515]

I'm a long term fan of Ryan's and this is the best talk he's ever made.

[@nulcable]

I just watched this and must say I am very impressed. Excellent tips! Thank you very much indeed!

[@dotcaodin]

Amazing.

[@rj_chap]

Thank you!

[@somberrage4692]

You're amazing.

[@rj_chap]

@@somberrage4692 Dawwww thanks! I have a lot of passion for what we do in our community.

[@araneascience9607]

First!