Threat Hunting

If you miss the initial access, there’s often still time to stop the ransomware. This section will go over some detection strategies.

In This Section

The Ransomware Seek and Destroy Mission

The Handoff from IABs to Ransomware Affiliates

Many people don’t understand that there’s more than one group involved in most ransomware attacks. The Initial Access Broker (IAB) gains the initial access and either sells or turns over the compromised system to the ransomware group. Understand how this process works and the tools used in these attacks.

Threat Hunting

Ransomware groups use a combination of third-party programs and Windows-native tools for reconnaissance and lateral movement in a ransomware attack. Learn how ransomware groups use these tools and, more importantly, how organizations can detect and stop them.

A Little Bit About Ransomware and Threat Hunting
Tools Used by Ransomware Actors
Cobalt Strike
Tools Used by Network Defenders
Sysmon: The Best Tool That No One Uses
Distinguishing Legitimate Traffic from Illegitimate
Rapid Response

Ransomware and Your Active Directory

For many ransomware groups, getting access to Active Directory servers is key to deploying their ransomware. Understand why Active Directory access is so key, what to look for on your Active Directory server for signs of a ransomware attack, and how to harden your Active Directory installation to keep ransomware actors at bay.

Gaining Access to Your Active Directory
Segmenting Your Networks and Your Active Directory Domain Controllers
Mimikatz
ADFinder
Using Your Active Directory to Deploy Ransomware
Stealing Credentials

Honeypots and Honeyfiles

When deployed and monitored correctly, honeypots and honeyfiles can provide an added layer of security against ransomware attacks. Honeypots can serve as “canaries” in the coal mine warning victims of an imminent ransomware attack.

This Is Your Last Chance

If all other defenses fail, there is one last thing an organization can do to protect themselves from a ransomware attack, if they have the right alerting and automation in place. Deleting shadow copies is an important part of a ransomware attack, but it should also be a red flag to the security team that something bad is about to happen. Learn how to take this seeming failure and turn it into at least a partial win.

Get More Ransomware Tools Directly In Your Inbox

Don’t worry, we hate spam too

Download The “How To Prevent Ransomware” Cheat Sheet

Grab this free PDF resource on how to prevent Ransomware

Share This Resource With Others

Embed The “How To Prevent Ransomware” resource on your site or blog using this code.

<p><strong>Please include attribution to ransomware.org with this graphic.</strong><br /><br /><a href='https://ransomware.org/how-to-prevent-ransomware/'><img data-src='https://ransomware.org/wp-content/uploads/2022/08/how-to-prevent-ransomware-infographic.png' alt='How To Prevent Ransomware' 540px border='0' src='data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==' class='lazyload' style='--smush-placeholder-width: 1080px; --smush-placeholder-aspect-ratio: 1080/900;' /><noscript><img src='https://ransomware.org/wp-content/uploads/2022/08/how-to-prevent-ransomware-infographic.png' alt='How To Prevent Ransomware' 540px border='0' /></noscript></a></p>

Threat Hunting

In This Section

Get More Ransomware Tools Directly In Your Inbox

Download The “How To Prevent Ransomware” Cheat Sheet

Share This Resource With Others

Want More?

Need Help?

Ransomware

Partners

Deep Dive

Is This Your Business?
Get In Touch

Before You Go!
Sign up to stay up to date with everything ransomware

JUST RELEASED: The 2024 State of Ransomware Survey is in.

Free Download Now &
Stay Ahead In Future

Threat Hunting

In This Section

Get More Ransomware Tools Directly In Your Inbox

Download The “How To Prevent Ransomware” Cheat Sheet

Share This Resource With Others

Want More?

Need Help?

Ransomware

Partners

Deep Dive

Is This Your Business? Get In Touch

Before You Go! Sign up to stay up to date with everything ransomware

JUST RELEASED: The 2024 State of Ransomware Survey is in.

Free Download Now & Stay Ahead In Future

Is This Your Business?
Get In Touch

Before You Go!
Sign up to stay up to date with everything ransomware

Free Download Now &
Stay Ahead In Future