Detecting & Hunting Ransomware Operator Tools: It Is Easier Than You Think!

Ryan Chapman, SANS Instructor and author of SANS FOR528: Ransomware for Incident Responders, provides an overview of tools leveraged often by ransomware operators. Though a multitude of ransomware operations and affiliate groups exist, we see a great deal of overlap between the tools leveraged by these groups (and that's an understatement!).
- Are you following and utilizing projects such as Living Off Trusted Sites (LOTS) and Bring Your Own Vulnerable Driver (BYOVD)?
- Are you looking for Bloodhound/SharpHound?
- Do …

affiliate author bloodhound bring your own vulnerable driver byovd deal driver great hunting incident incident responders operations own projects ransomware sans tools vulnerable vulnerable driver work