book

Incident Response Techniques for Ransomware Attacks

Name: Incident Response Techniques for Ransomware Attacks
Author: Oleg Skulkin
ISBN: 9781803240442

by Oleg Skulkin

April 2022

Beginner to intermediate

228 pages

4h 34m

English

Packt Publishing

Read now

Unlock full access

Incident Response Techniques for Ransomware Attacks
ContributorsAbout the authorAbout the reviewer
Preface
Who this book is forWhat this book coversDownload the color imagesConventions usedGet in touchDisclaimerShare Your Thoughts
Section 1: Getting Started with a Modern Ransomware Attack
Chapter 1: The History of Human-Operated Ransomware Attacks
2016 – SamSam ransomwareWho was behind the SamSam ransomware2017 – BitPaymer ransomwareThe mastermind behind the BitPaymer ransomware2018 – Ryuk ransomwareWho was behind the Ryuk ransomware?2019-present – ransomware-as-a-serviceWho was behind ransomware-as-a-service programs?Summary
Chapter 2: The Life Cycle of a Human-Operated Ransomware Attack
Initial attack vectorsRDP compromiseSpear phishingSoftware vulnerabilitiesPost-exploitationData exfiltrationRansomware deploymentSummary
Chapter 3: The Incident Response Process
Preparation for an incidentThe teamThe infrastructureThreat detection and analysisContainment, eradication, and recoveryPost-incident activitySummary
Section 2: Know Your Adversary: How Ransomware Gangs Operate
Chapter 4: Cyber Threat Intelligence and Ransomware
Strategic cyber threat intelligenceOperational cyber threat intelligenceTactical cyber threat intelligenceSummary
Chapter 5: Understanding Ransomware Affiliates' Tactics, Techniques, and Procedures
Gaining initial accessExternal remote services (T1133)Exploiting public-facing applications (T1190)Phishing (T1566)Supply chain compromise (T1195)Executing malicious codeUser execution (T1204)Command and scripting interpreters (T1059)Exploitation for client execution (T1203)Windows Management Instrumentation (T1047)Obtaining persistent accessValid accounts (T1078)Create account (T1136)Boot or logon autostart execution (T1547)Scheduled task/job (T1053)Server software component (T1505)Escalating privilegesExploiting for privilege escalation (T1068)Creating or modifying system process (T1543)Process injection (T1055)Abuse elevation control mechanism (T1548)Bypassing defensesExploiting for defense evasion (T1211)Deobfuscating/decoding files or information (T1140)File and directory permissions modification (T1222)Impairing defenses (T1562)Indicator removal on host (T1070)Signed binary proxy execution (T1218)Accessing credentialsBrute force (T1110)OS credential dumping (T1003)Steal or forge Kerberos tickets (T1558)Moving laterallyExploiting remote services (T1210)Remote services (T1021)Using alternate authentication material (T1550)Collecting and exfiltrating dataData from local system (T1005)Data from network shared drives (T1039)Email collection (T1114)Archive collected data (T1560)Exfiltration over web service (T1567)Automated exfiltration (T1020)Ransomware deploymentInhibit system recovery (T1490)Data encrypted for impact (T1490)Summary
Chapter 6: Collecting Ransomware-Related Cyber Threat Intelligence
Threat research reportsCommunityThreat actorsSummary

Section 3: Practical Incident Response
Chapter 7: Digital Forensic Artifacts and Their Main Sources
Volatile memory collection and analysisNon-volatile data collectionMaster file tablePrefetch filesLNK filesJump listsSRUMWeb browsersWindows RegistryWindows event logsOther log sourcesSummary
Chapter 8: Investigating Initial Access Techniques
Collecting data sources for an external remote service abuse investigationInvestigating an RDP brute-force attackCollecting data sources for a phishing attack investigationInvestigating a phishing attackSummary
Chapter 9: Investigating Post-Exploitation Techniques
Investigating credential access techniquesCredential dumping with hacking toolsCredential dumping with built-in toolsKerberoastingInvestigating reconnaissance techniquesNetwork scanningActive Directory reconnaissanceInvestigating lateral movement techniquesAdministrative sharesPsExecRDPSummary
Chapter 10: Investigating Data Exfiltration Techniques
Investigating web browser abuse for data exfiltrationInvestigating cloud service client application abuse for data exfiltrationInvestigating third-party cloud synchronization tool abuse for data exfiltration Investigating the use of custom data exfiltration toolsSummary
Chapter 11: Investigating Ransomware Deployment Techniques
Investigation of abusing RDP for ransomware deploymentCrylock ransomware overviewInvestigation of Administrative shares for ransomware deploymentREvil ransomware overviewInvestigation of Group Policy for ransomware deploymentLockBit ransomware overviewSummary
Chapter 12: The Unified Ransomware Kill Chain
Cyber Kill Chain®ReconnaissanceWeaponizationDeliveryExploitationInstallationCommand and Control (C2)Actions on ObjectivesMITRE ATT&CK®ReconnaissanceResource developmentInitial accessExecutionPersistencePrivilege escalationDefense evasionCredential accessDiscoveryLateral movementCollectionCommand and controlExfiltrationImpactThe Unified Kill ChainInitial FootholdNetwork PropagationActions on ObjectivesThe Unified Ransomware Kill ChainGain Access to the NetworkEstablish FootholdNetwork DiscoveryKey Assets DiscoveryNetwork PropagationData ExfiltrationDeployment PreparationRansomware DeploymentExtortionSummary
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Content preview from Incident Response Techniques for Ransomware Attacks

Chapter 8: Investigating Initial Access Techniques

In the previous chapter, we looked at various sources of digital forensic artifacts available on Windows systems. Now, it's time to start looking at some case studies so that we can understand how exactly those artifacts can be used for ransomware attack life cycle reconstruction.

We'll start by finding evidence for the most common initial access techniques – abusing external remote services and phishing.

Abusing external remote services, especially publicly exposed RDP servers, is an extremely common technique. However, more than 50% of successful attacks start from a successful brute-force attack against such servers.

Almost the same can be said about phishing – lots of different bots, which ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Ransomware Revealed: A Beginner’s Guide to Protecting and Recovering from Ransomware Attacks

Publisher Resources

ISBN: 9781803240442

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Incident Response Techniques for Ransomware Attacks

by Oleg Skulkin

Chapter 8: Investigating Initial Access Techniques

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.