SANS DFIR

Clarification: Protocol SIFT is an experimental research initiative exploring how AI can accelerate IR workflows against AI-enabled threats. It is not forensically sound, court-admissible, or validated for evidentiary use at this time Project overview: go.sans.org/pYc6Ic

What is #ClickFix & why should you care? It's becoming a big path to #Ransomware access. Hear how these attacks unfold & what to look out for! 👉Join us April 7th at 1PM EST: buff.ly/js9lJEy

What is changing in the threat landscape this year? Hear how attacker behavior is shifting and what trends teams should be paying attention to. Join us May 21 | 1 PM EST: buff.ly/etizrzD #CTI #ThreatIntel #DFIR

How are #Ransomware actors getting initial access today? #SocialEngineering is playing a bigger role with tactics like #ClickFix & Teams-based attacks showing up more often. Join @rj_chap & @maridegrazia to see how it works, LIVE on Apr. 7 @ 1 PM EST: buff.ly/js9lJEy

The SANS #DFIRSummit returns this fall with two days of highly technical sessions covering the latest in: 🔎 Digital Forensics 🚨 Incident Response 🎯 Threat Hunting 🔐 Ransomware 🗓️ Summit: Oct 15–16 📍 Arlington, VA & 🌐 Live Online 🔗 go.sans.org/TSSBBf

⭐️ What if #Ransomware intel reports could generate themselves every few hours? This open-source ransomware intelligence agent pulls data from ransomware live, analyzes it, & produces a full report. 👉 See how it works. Read the blog: go.sans.org/rPdjN3

AI-driven threats aren’t slowing down — and neither can your investigations. Join us at SANS #AISummit (Apr 20–21) to explore how AI is reshaping detection, response, and threat analysis. 📍 Arlington, VA & Free Live Online ➡️ sans.org/u/1CNB

Your logs are talking — are you listening? Join us in Arlington at #AISummit (Apr 20–21) for 2 days of talks & workshops, incl. a hands-on session w/ Matthew Seyer & Devanshi Agnihotri using AI/ML to surface attacker activity & analyze data at scale. ➡️ sans.org/u/1CNB

The threat landscape just changed — fast. Join us at SANS #AISummit (Apr 20–21) when Jacob Klein discusses how AI is enabling low-skill actors to scale, small teams to hit APT weight, and is reshaping real-world cyber ops. ➡️ sans.org/u/1CNB

The #DFIRSummit is back this fall! Join us for the latest in digital forensics, incident response, threat hunting, & ransomware. 🗓️ Summit: Oct 15–16 📍 Arlington, VA | All-Access + Workshops 🌐 Live Online | Select talks 💻 Training: Oct 17–22 Register: go.sans.org/TSSBBf

🚨 In case you didn't know! @rj_chap & @maridegrazia host a monthly livestream discussing the latest #Ransomware threats that you need to know about! The livestream airs the 1st Tuesday of each month. 🎥 Check out past episodes: buff.ly/qIdjgC6 #DFIR

#AI is lowering the barrier to entry for #Ransomware actors. It’s also democratizing expertise for defenders. From automated alert triage to #MITRE-mapped timelines, here’s what we covered in Feb’s livestream recap. → Read it here: go.sans.org/UGL1Au

👥 We come to sharpen skills, but the true value is in the convos, shared challenges, & the sense we’re in this together. Ready to forge connections & skills to protect your org? We'll see you in a #FOR589 soon! ✍️ Learn more about FOR589: buff.ly/DDa8ScC #DFIR

📄 Need a handy reference for your forensic investigations? Our #SIFT Cheat Sheet is designed for #DFIR analysts with essential tools and techniques on the SANS #Linux SIFT Workstation Download your copy: buff.ly/PM3AKjT

Happening tomorrow. The SANS IR Command Roundtable is a discussion on early incident response decisions, coordination under pressure, and avoiding missteps when incidents escalate. March 5 Register now: bit.ly/3OTpP6X #IncidentResponse #CyberSecurity #DFIR

#AI is lowering the barrier to entry for #Ransomware actors. It’s also democratizing expertise for defenders. From automated alert triage to #MITRE-mapped timelines, here’s what we covered in Feb’s livestream recap. → Read it here: go.sans.org/UGL1Au

👉 Everyone wants to be first. Not everyone wants to be right. Admiralty Code Part 2 walks through Ticketmaster breach claims using the Admiralty System + a Timeline approach. 📖 Read the blog: buff.ly/Wjnp5pY #CTI #Cybercrime #DFIR

Live > static when incidents escalate. The SANS IR Command Roundtable is a discussion on early decision-making, coordination under pressure, and safe containment when response really matters. March 5 Register now: bit.ly/4cv9jEd #IncidentResponse #CyberSecurity #DFIR

👉 We’re walking through a simulated #Ransomware incident, from artifact collection to attributed intelligence report, w/ an #AI agent doing ALL the heavy lifting. 🚨Join us at 1PM EST today! Set your reminder: buff.ly/rRDZFsq #DFIR #Cybersecurity

🚨Join @rj_chap, @maridegrazia & Raymond DePalma as they build an #AI agent that turns #Ransomware artifacts into attributed intel reports, with open-source #DFIR innovation. 👉 Join us tomorrow! Set your reminder: linkedin.com/events/7432432…