MalwareMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.Ransomware & Threat Response
Handle a ransomware attack from first call to recovery, reporting and lessons learnt.
- Intermediate
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
Ransomware is the incident most Indian organisations fear, and with reason. Hospitals, manufacturers and small offices have all been hit. In a typical case the attacker logs in through an exposed RDP port or a phishing email, spends days moving around the network, copies data out and then encrypts servers and backups in one night.
This course walks you through a ransomware incident from the first phone call. You learn how to contain without destroying evidence, how to find the way in, how to work out which systems and data were touched and how to read what the attacker left behind, from ransom notes to deleted shadow copies.
It also covers the duties that come with an incident in India. The CERT-In direction of April 2022 requires many incidents, including ransomware, to be reported within 6 hours of being noticed. The DPDP Act 2023 adds duties when personal data is affected. The course ends with recovery and a lessons learnt review so the same door is not left open again.
Initial accessScopingCERT-In reportingRecovery
After this course you can
- Run the first hours of a ransomware response, including containment that keeps evidence intact
- Find the initial access route, such as RDP, phishing or a flaw in a VPN appliance
- Scope the incident by tracing lateral movement, credential theft and data exfiltration
- Read ransom notes, encrypted file patterns and signs such as shadow copy deletion
- Meet the CERT-In 6-hour reporting direction and prepare the facts needed for it
- Plan recovery from clean backups and lead a lessons learnt review
Syllabus
7 modules · 28 topics
01How ransomware attacks work4 topics
- Stages of an attack from initial access to encryption
- Ransomware as a service and double extortion with leak sites
- Common tools attackers use, such as PsExec, Mimikatz, AnyDesk and Rclone
- Attacks on hypervisors and backup servers
02Initial access4 topics
- Exposed RDP and weak passwords, seen in event IDs 4624 (logon type 10), 4625 and 1149
- Phishing attachments and links that lead to loaders
- Unpatched VPN and firewall appliances
- Stolen credentials and access bought from brokers
03First response and containment4 topics
- Isolating systems without powering them off and losing memory
- Preserving logs, memory and a sample of encrypted files
- Protecting backups that have not yet been hit
- Keeping a clear decision log from the first hour
04Scoping the incident4 topics
- Lateral movement through RDP, SMB and remote services
- Service installs (event 7045), cleared logs (event 1102) and new accounts
- Signs of data theft in firewall logs and tools such as Rclone
- Building an incident timeline across many machines
05Reading the attacker's traces4 topics
- Ransom notes, file extensions and identifying the family
- Shadow copy deletion with vssadmin and wmic, and recovery being turned off with bcdedit
- Checking the No More Ransom project for known decryptors
- Collecting samples for malware analysis
06Reporting and legal duties4 topics
- CERT-In directions of 28 April 2022 under Section 70B(6) of the IT Act 2000
- Reporting within 6 hours and the facts you need ready
- Personal data breach notice under the DPDP Act 2023
- Complaints to the police and working with insurers and lawyers
07Recovery and lessons learnt4 topics
- Rebuilding from clean, tested backups
- Resetting credentials, including domain admin and service accounts
- Fixing the entry point and watching for the attacker's return
- Running a lessons learnt review and updating the response plan
Hands-on labs
- Lab 1
Find the RDP brute force and successful login that started a simulated ransomware attack
- Lab 2
Trace lateral movement across three servers using Windows event logs
- Lab 3
Identify a ransomware family from its note and encrypted files and check for a decryptor
- Lab 4
Prepare an incident summary with the details needed for a CERT-In report
- Lab 5
Run a tabletop exercise on recovery and write a lessons learnt note
Tools you will use
- KAPE
- Velociraptor
- Eric Zimmerman's tools (EvtxECmd, Timeline Explorer)
- Hayabusa
- Volatility 3
- Wireshark
Who it suits
- IT and security teams in companies, hospitals and government offices
- SOC and incident response analysts
- Managers who must lead or approve decisions during an incident
- Police officers who handle ransomware complaints
Before you join
- Good working knowledge of Windows networks and Active Directory
- Basic understanding of logs and event viewer
- Memory Forensics or Network Traffic Analysis helps
Questions about this course
Does the course teach whether to pay the ransom?
The course does not advise paying or not paying. It covers the facts that feed that decision, such as whether backups survived, what data was taken and what legal and policy points need checking. The final decision belongs to the organisation's management with its legal advisers.
Who has to report to CERT-In within 6 hours?
The April 2022 directions apply to service providers, intermediaries, data centres, body corporates and government organisations, and ransomware is among the listed incident types. The course explains how to check whether your organisation is covered and what a report should contain.
Is this course useful for managers without a technical background?
The labs are technical, but the response, reporting and lessons learnt modules are written for decision makers too. Many teams send one manager along with their analysts.
More courses in Incident Response & Malware Analysis
MalwareMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MalwareMalware Reverse EngineeringTake malware apart safely with static and dynamic analysis, Ghidra, x64dbg and YARA.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.