Visão Geral

Este curso aborda resposta a incidentes de ransomware, incluindo identificação, contenção, investigação, análise de impacto, proteção de backups, erradicação e recuperação de ambientes.

Objetivo

Após realizar este curso, você será capaz de:

• Identificar incidentes de ransomware
• Executar contenção
• Investigar a cadeia de ataque
• Apoiar recuperação segura

Publico Alvo

• Incident Responders
• SOC e Blue Team
• Administradores de infraestrutura
• Cybersecurity Professionals

Pre-Requisitos

• Conhecimentos de incident response
• Familiaridade com Windows
• Conhecimentos de redes
• Conhecimentos básicos de Active Directory
• Familiaridade com backup e recuperação

Conteúdo Programatico

Module 1: Ransomware Fundamentals

1. Ransomware attack lifecycle
2. Ransomware families
3. Initial Access
4. Execution
5. Persistence
6. Credential Access
7. Lateral Movement
8. Data encryption
9. Data exfiltration
10. Impact assessment

Module 2: Ransomware Detection

1. Early warning indicators
2. Suspicious processes
3. File modification activity
4. Authentication anomalies
5. Network anomalies
6. Endpoint telemetry
7. EDR alerts
8. SIEM detection
9. Behavioral detection
10. Ransomware hunting

Module 3: Initial Response

1. Incident triage
2. Scope identification
3. Host isolation
4. Network containment
5. Account containment
6. Credential protection
7. Backup protection
8. Evidence preservation
9. Incident escalation
10. Initial response documentation

Module 4: Attack Chain Investigation

1. Initial Access investigation
2. Credential theft
3. Privilege escalation
4. Active Directory compromise
5. Lateral Movement
6. Persistence
7. Command and Control
8. Data exfiltration
9. Attack timeline
10. Root cause analysis

Module 5: Containment and Eradication

1. Enterprise containment
2. Endpoint isolation
3. Account remediation
4. Credential reset
5. Persistence removal
6. Malware removal
7. Compromised system identification
8. Security control reinforcement
9. Eradication validation
10. Threat actor removal

Module 6: Backup and Recovery

1. Backup security
2. Backup integrity
3. Offline backups
4. Recovery priorities
5. System restoration
6. Active Directory recovery
7. Application recovery
8. Recovery validation
9. Post-recovery monitoring
10. Business continuity

Module 7: Post-Incident Analysis

1. Root cause analysis
2. Attack timeline
3. Initial Access analysis
4. Security control gaps
5. Detection gaps
6. Recovery lessons
7. Security improvements
8. Threat intelligence
9. Incident reporting
10. Ransomware response improvement

Module 8: Practical Ransomware Response

1. Ransomware detection
2. Initial triage
3. Scope assessment
4. Containment
5. Evidence collection
6. Attack reconstruction
7. Eradication
8. Recovery
9. Post-incident analysis
10. Ransomware incident case study