SANS Courses

Stay Ahead of Ransomware - Threat Hunting for Ransomware and Cyber Extortion

Discover proactive threat hunting techniques to identify ransomware actors operating in your environment before they strike, featuring expert insights from Sydney Marone.

• YouTube
• 57 minutes
• Self-Paced
• Free Video

When the Threat Group Doesn't Leave - Incident Response Under Fire

Explore real-world cyber extortion response tactics against active threat groups, covering TTPs, containment challenges, and critical incident management strategies.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Mobile Device Hardening - A Forensic Comparison of Advanced Protection Programmes in iOS and Android

Explore how Apple's Lockdown Mode and Google's Advanced Protection impact digital forensics, comparing iOS vs Android security architectures and investigative techniques.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

PDF Forensics and Authenticity Detection

Discover practical techniques to identify tampered PDF documents using digital clues, metadata analysis, and open-source tools for fraud detection and legal verification.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

MacOS Telemetry vs EDR Telemetry - Which is Better?

Discover how macOS Unified Logging System captures deeper forensic data than EDR tools, with actionable methods to enhance incident response investigations on Apple systems.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Home Automation and IoT as a Source of Evidence - Forensic Analysis of Home Assistant

Uncover forensic opportunities in Home Assistant to analyze user movements, device usage, and environmental data with precise timestamps for digital investigations.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Extracting the Unseen - Real-World RAM Acquisition and Analysis from Android Devices

Discover practical techniques for acquiring and analyzing volatile memory from Android devices to uncover encryption keys, credentials, and transient data missed by traditional forensic methods.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Hunting Payloads in Linux Extended File Attributes

Discover how attackers hide malicious payloads in Linux extended file attributes and learn defensive techniques to detect and investigate this evasion method effectively.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

The Art of Concealment - How Cybercriminals Are Becoming and Remaining Anonymous

Discover the CLOAK framework cataloguing 1,300+ concealment tactics used by cybercriminals to hide identities and evade attribution in digital investigations.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Location Log Analysis of Google Maps iOS

Explore forensic analysis of Google Maps' new iOS location-history.json format, examining semantic segments and using open-source tools for investigative workflows.

• YouTube
• 14 minutes
• Self-Paced
• Free Video

Kanvas - The Only Case Management Tool You Need When Spreadsheets Fail Your IR Case Management

Discover Kanvas, a Python/Qt desktop tool that replaces cumbersome spreadsheets in incident response case management with streamlined tracking and automated documentation features.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Stay Ahead of Ransomware - Proper Incident Containment and Horror Stories

Discover essential ransomware incident response strategies, containment processes, and data preservation techniques through real-world case studies and expert insights.

• YouTube
• 1 hour 1 minute
• Self-Paced
• Free Video

Staying Ahead of Ransomware: Communication During a Ransomware Engagement

Discover effective communication strategies for ransomware incidents, from managing internal team coordination to public responses and consumer notifications during and after the crisis.

• YouTube
• 58 minutes
• Self-Paced
• Free Video

Breaking Bad Actors - Transforming Threat Intelligence into RaaS Resilience

Discover how to transform threat intelligence data into actionable RaaS defense strategies through leak site analysis and real-world incident insights.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Detecting Initial Access Malware Before It's Too Late

Discover behavioral detection techniques to identify initial access malware like Lumma Stealer and Bumblebee before ransomware deployment, with practical hunting queries.

• YouTube
• 29 minutes
• Self-Paced
• Free Video