IR309 Ransomware Threat Hunting Workshop

#1760005: IR309 Ransomware Threat Hunting Workshop - Dec 2

Description:	Get ready to step into a live ransomware incident—and hunt the intruder down before the damage is done. We’re excited to offer the Ransomware Threat Hunting Workshop, a hands-on experience that puts you directly into the role of a cyber defender investigating an active ransomware incident. In this workshop, you’ll join an investigation team inside Microsoft Sentinel and work through a realistic ransomware simulation from the inside. Intruders will deliver a ransomware binary through a phishing campaign, move through the environment, and begin encrypting user files for impact. Your job is to catch them in the act. Working in teams, you’ll go beyond passive alerting and proactively hunt for adversary activity across the environment. You’ll investigate telemetry, chase leads, identify anomalous behavior, and make decisions alongside your teammates to contain and mitigate the threat. This is a hunt—not a lecture. What You’ll Do: -Investigate a live simulation: Trace a ransomware intrusion from phishing-based delivery through execution and encryption impact. -Hunt proactively: Use Microsoft Sentinel SIEM and other available security tools to pursue threats across the environment rather than waiting for an alert to fire. -Detect anomalies: Analyze SIEM data and telemetry to identify the behaviors that reveal threat actor activity. -Mitigate and contain: Turn your findings into action and work to stop the intrusion before it spreads. Before and After the Workshop: Your learning experience extends beyond the live workshop. You’ll receive access to pre-course materials and on-demand labs. Please review all pre-course materials before the workshop. The preparation is designed to help you arrive ready to participate fully in the hands-on investigation and get the most from your time with your team. After the workshop, you will have access to the on-demand labs for 24 hours to continue practicing and reinforcing the skills you developed during the live experience. Come ready to investigate, collaborate, and think like a defender under pressure. You’ll leave with sharper threat-hunting skills and hands-on Microsoft Sentinel experience you can take straight back to the SOC.
More info:	https://cisa.webex.com/webappng/sites/cisa/webinar/webinarSeries/register/ddcbfce3c8da4520b853d810ff030b7b

Description:

Get ready to step into a live ransomware incident—and hunt the intruder down before the damage is done.

We’re excited to offer the Ransomware Threat Hunting Workshop, a hands-on experience that puts you directly into the role of a cyber defender investigating an active ransomware incident.

In this workshop, you’ll join an investigation team inside Microsoft Sentinel and work through a realistic ransomware simulation from the inside. Intruders will deliver a ransomware binary through a phishing campaign, move through the environment, and begin encrypting user files for impact.

Your job is to catch them in the act.

Working in teams, you’ll go beyond passive alerting and proactively hunt for adversary activity across the environment. You’ll investigate telemetry, chase leads, identify anomalous behavior, and make decisions alongside your teammates to contain and mitigate the threat.

This is a hunt—not a lecture.

What You’ll Do:

-Investigate a live simulation: Trace a ransomware intrusion from phishing-based delivery through execution and encryption impact.
-Hunt proactively: Use Microsoft Sentinel SIEM and other available security tools to pursue threats across the environment rather than waiting for an alert to fire.
-Detect anomalies: Analyze SIEM data and telemetry to identify the behaviors that reveal threat actor activity.
-Mitigate and contain: Turn your findings into action and work to stop the intrusion before it spreads.

Before and After the Workshop:
Your learning experience extends beyond the live workshop. You’ll receive access to pre-course materials and on-demand labs.

Please review all pre-course materials before the workshop. The preparation is designed to help you arrive ready to participate fully in the hands-on investigation and get the most from your time with your team.

After the workshop, you will have access to the on-demand labs for 24 hours to continue practicing and reinforcing the skills you developed during the live experience.

Come ready to investigate, collaborate, and think like a defender under pressure. You’ll leave with sharper threat-hunting skills and hands-on Microsoft Sentinel experience you can take straight back to the SOC.

More info:

https://cisa.webex.com/webappng/sites/cisa/webinar/webinarSeries/register/ddcbfce3c8da4520b853d810ff030b7b

Date added	Nov. 2, 2026, 4:21 p.m.
Source	Webex
Subjects	PodCasts / Webcast / Webinar / eSummit / Virtual Event etc. Ransomware - Cyber Extortion - New Reports in
Venue	Dec. 1, 2026, midnight - Dec. 2, 2026, midnight