What did the external consultants recommend initially?

Deploying IR agents to all machines (a $300k cost).

What was the result of Rendition's 'second opinion'?

They descoped two systems and validated the original indicators were false positives.

Analysis of Competing Hypotheses.

How did Rendition decrypt the ransomware files?

They located the key for one machine in memory.

What is the risk of paying the ransom?

It identifies you as a target who pays and lacks backups.

What should be done after paying a ransom?

Perform threat hunting to ensure the attacker has no remaining access.

What administrative change was recommended post-ransomware?

Remove local admin rights from most users.

Rendition Infosec Case Studies

Rendition Infosec case studies.pptx

Case studies on ransomware and intrusion analysis by Rendition Infosec.

This page contains AI generated content. Errors or omissions may be present. Use human level critical thinking.

Q: What tool did internal security use in the PHI case?

A: Redline.
Q: What did the external consultants recommend initially?

A: Deploying IR agents to all machines (a $300k cost).
Q: What was the result of Rendition's 'second opinion'?

A: They descoped two systems and validated the original indicators were false positives.
Q: What is 'ACH'?

A: Analysis of Competing Hypotheses.
Q: How did Rendition decrypt the ransomware files?

A: They located the key for one machine in memory.
Q: What is the risk of paying the ransom?

A: It identifies you as a target who pays and lacks backups.
Q: What should be done after paying a ransom?

A: Perform threat hunting to ensure the attacker has no remaining access.
Q: What administrative change was recommended post-ransomware?

A: Remove local admin rights from most users.
Q: What technology was disabled by admins to save disk space?

A: Volume Shadow Copies.
Q: What was found during the post-ransomware threat hunt?

A: Two remote access trojans.

Ask a question

Have a doubt or need clarification?

  I’m here to help. Share your question, and I’ll get back to you with the guidance you need regarding the course.

Ask a question

Thank you!