How to Effectively Investigate a Human-Operated Ransomware Attack

One of the most common types of attacks modern incident responders face is human-operated ransomware. There're quite a few challenges you may deal with during investigation: many pieces of valuable data are encrypted, threat actors still have access to the compromised environment, no proper logging... This talk will help you to effectively investigate such attacks using only default artifacts available in any network.

SANS DFIR Summit 2023
How to Effectively Investigate a Human-Operated Ransomware Attack in a Network Without Advanced …

access attack attacks challenges compromised data deal effectively encrypted environment human human-operated ransomware incident incident responders investigation logging may ransomware ransomware attack threat threat actors types