IR224 - Anatomy of an Attack Series - Ransomware Unmasked: Attack Simulation and Investigation for Blue Teamers Workshop

#1744575: IR224 - Anatomy of an Attack Series - Ransomware Unmasked: Attack Simulation and Investigation for Blue Teamers Workshop

Description:	This intensive two-day workshop equips cybersecurity defenders with essential skills to understand, simulate, and investigate ransomware threats. Participants begin by stepping into the attacker’s mindset, building and operating a command-and-control infrastructure and executing a full ransomware scenario—from initial access through lateral movement and data staging. The second day shifts to incident investigation and response. Participants will perform log analysis, endpoint inspection, timeline creation, and forensic data collection—mirroring real-world investigations in a dynamic lab environment. Each participant receives their own dedicated, cloud-hosted lab to ensure skill building in a safe, simulated enterprise setting. This workshop delivers a practical fusion of offensive and defensive techniques to deepen participants’ ability to detect and respond to ransomware incidents. Level: Beginner to intermediate Learning Objectives By the end of this workshop, participants will be able to: -Analyze the complete lifecycle of a ransomware attack, from access brokering to data extortion. -Deploy and operate a command-and-control framework to simulate attacker behavior. -Map attacker tactics, techniques, and procedures (TTPs) using a standardized threat model. -Conduct forensic investigations across log data, system artifacts, and endpoint telemetry. -Identify credential theft, lateral movement, and common evasion methods. -Recognize persistence mechanisms and understand attacker use of legitimate tools (LOLBAS). -Reconstruct attack timelines and trace adversary activity across compromised systems. -Apply structured incident response practices—from detection through containment and reporting. -Strengthen analytical judgment through exposure to both red and blue team methodologies.
More info:	https://cisa.webex.com/webappng/sites/cisa/webinar/webinarSeries/register/812d744d11424a6fa260fb82f35fa14c

Description:

This intensive two-day workshop equips cybersecurity defenders with essential skills to understand, simulate, and investigate ransomware threats. Participants begin by stepping into the attacker’s mindset, building and operating a command-and-control infrastructure and executing a full ransomware scenario—from initial access through lateral movement and data staging.

The second day shifts to incident investigation and response. Participants will perform log analysis, endpoint inspection, timeline creation, and forensic data collection—mirroring real-world investigations in a dynamic lab environment. Each participant receives their own dedicated, cloud-hosted lab to ensure skill building in a safe, simulated enterprise setting.

This workshop delivers a practical fusion of offensive and defensive techniques to deepen participants’ ability to detect and respond to ransomware incidents.

Level: Beginner to intermediate

Learning Objectives
By the end of this workshop, participants will be able to:
-Analyze the complete lifecycle of a ransomware attack, from access brokering to data extortion.
-Deploy and operate a command-and-control framework to simulate attacker behavior.
-Map attacker tactics, techniques, and procedures (TTPs) using a standardized threat model.
-Conduct forensic investigations across log data, system artifacts, and endpoint telemetry.
-Identify credential theft, lateral movement, and common evasion methods.
-Recognize persistence mechanisms and understand attacker use of legitimate tools (LOLBAS).
-Reconstruct attack timelines and trace adversary activity across compromised systems.
-Apply structured incident response practices—from detection through containment and reporting.
-Strengthen analytical judgment through exposure to both red and blue team methodologies.

More info:

https://cisa.webex.com/webappng/sites/cisa/webinar/webinarSeries/register/812d744d11424a6fa260fb82f35fa14c

Date added	July 6, 2026, 2:30 p.m.
Source	CISA
Subjects	PodCasts / Webcast / Webinar / eSummit / Virtual Event etc. Ransomware - Cyber Extortion - New Reports in
Venue	Aug. 4, 2026, midnight - Aug. 6, 2026, midnight