I Knew You Were Trouble – Detecting Threat Actors Before They Deploy Ransomware

The 2020 and 2021 news cycles have been full of stories related to the pandemic – but also with the rise of ransomware wreaking havoc across organizations, in turn amplifying public awareness of the issue. Report after report being released, citing new ransomware variants, ransomware affiliate models, and actors selling data on the dark web. The guidance provided by government agencies, security companies and researchers were the same: “Protect your environment – update your systems, use strong passwords!” But threat actors that use ransomware often are not leveraging new techniques or tactics capable of disrupting environments already taking these precautions. So how can we expect security teams to excel in detecting these devastating attacks?

This talk will explore common areas of improvements where defenders, threat hunters, and incident responders alike can focus efforts to identify most threat actors that leverage ransomware early in the attack life cycle. After all, early detection puts your team in a much better position than that dreaded late Friday afternoon discovery that ransomware is spreading through the enterprise environment.

Kirstie Failey, Senior Incident Response Consultant, Mandiant - twitter.com/gigs_security

View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#ThreatHuntingSummit #