Ryan Chapman
Certified InstructorTeam Lead, Managed Threat Hunting at Palo Alto Networks
Specialities
Digital Forensics and Incident Response
SEC504: Hacker Tools, Techniques, and Incident Handling
SEC504Offensive Operations
FOR528: Ransomware and Cyber Extortion
FOR528Digital Forensics and Incident Response
- 4 Days (Instructor-Led)
- 24 CPEs / 24 Hours (Self-Paced)
- Labs: 13 Hours of hands-on instruction
Virtual Events
Explore content featuring this instructor’s insights and expertise.
- Slide 1 of 3
意外と簡単なランサムウェア運用ツールの検出と駆逐
今回のCommunity Nightでは､SANSの「FOR528: Ransomware for Incident Responders」の開発者であるRyan Chapmanが、ランサムウェアの運用に活用されているツールについて紹介します。ランサムウェアの運用については様々なバリエーションが存在しますが、活用されているツールには重複している点も少なくありません。
WebinarDigital Forensics and Incident Response
- 29 Mar 2023
- 18:00 AEDT
- Ryan Chapman
- Slide 2 of 3
Community Night SANS Secure Australia 2023 - Detecting & Hunting Ransomware Operator Tools: It Is Easier Than You Think!
Join us in this Community Night talk as Ryan Chapman, author of SANS FOR528: Ransomware for Incident Responders, provides an overview of tools leveraged often by ransomware operators. Though a multitude of ransomware operations and affiliate groups exist, we see a great deal of overlap between the tools leveraged by these groups (and that's an understatement!).
WebinarDigital Forensics and Incident Response
- 29 Mar 2023
- 18:00 AEDT
- Ryan Chapman
- Slide 3 of 3
Hands-on Malicious Script Analysis for Ransomware Response
A large majority of ransomware incidents involve both obfuscated scripts and Cobalt Strike. PowerShell reigns supreme as the most common type of obfuscated script found in ransomware cases. Do you know what to do should you find an obfuscated PowerShell script during response? What if you run into an obfuscated, PowerShell-based Cobalt Strike downloader? Do you know how to decode the downloader? Do you know how to review the shellcode found multiple levels within the code structure to determine where the Cobalt Strike beacon is being hosted?
WebinarDigital Forensics and Incident Response
- 16 Aug 2023
- 13:00 UTC
- Ryan Chapman