Choose Your Own Adventure: Group Interactive IR Scenario
summary
A live choose-your-own-adventure incident response scenario walks through a Friday ransomware call that escalates from phishing to credential theft to lateral SMB spread using HTTPS C2 through cloud infrastructure, infecting 8 machines with an executable called more bacon. The team finds delayed SIEM ingestion, missing backups, quarantines the eight hosts, makes forensic copies, and restores from a golden image within an hour; Atomic Red Team is recommended for testing and detection tuning.
AI-written summary · about
chapters (18)
- 0:00Introduction to Bryson
- 1:31Why interactive exercises
- 3:59Job security in cybersecurity
- 5:03Emotional cost of cybersecurity
- 9:57Choose Your Own Adventure setup
- 14:45Ransomware incident begins
- 20:56Initial response options
- 22:20Finding the needle in the haystack
- 25:00Data science in incident response
- 28:16Understanding Shadow IT
- 32:52MITRE ATT&CK framework
- 34:41Lateral movement detection
- 36:09Containment strategies
- 37:15Business impact and CMDBs
- 38:18Role of legal in incidents
- 41:11Forensic analysis and recovery
- 42:15Phishing new employees
- 44:00Rebuilding and morale
related talks
40mIncident Response – How to Give the Advantage to the Hackers!
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
27m“Why are they asking me to do this?” or Adventures in IR Land
54mExperience a simulated ransomware event: Learn now to prevail later
46m"Choose Your Own Disaster – Rusty and the Crate Escape!"
49mTraining for Incident Response: The Red, the Blue, and the Ugly
32mSurviving a Ransomware Attack - Lessons from the Field
21mRansomware Attack: Lessons Learned