rj_chap's profile picture. DFIR & malware analyst. @sansforensics FOR528 Author & FOR610 Instructor. @CactusCon crew. Husband & father. Comments = own.

Ryan "Chaps" Chapman

@rj_chap

DFIR & malware analyst. @sansforensics FOR528 Author & FOR610 Instructor. @CactusCon crew. Husband & father. Comments = own.

Fijado

It's that time folks!! Our @sansforensics #Ransomware and #CyberExtortion poster is officially out! Want to learn more about how to prevent, detect, and hunt for ransomware actors? Grab the poster! #RansomwareSucks #for528

NEW | @SANSInstitute #DFIR Poster by @4enzikat0r & @rj_chap #Ransomware & #CyberExtortion poster provides an overview of the ransomware business ecosystem & with key points related to each of the major phases of a typical extortion attack Download now! sans.org/u/1uCq



Ryan "Chaps" Chapman reposteó

CactusCon happens every year thanks to great people, talks, and sponsors. We are happy to welcome back the @eff as a community sponsor! You know love them as one of the leading voices in digital liberty advocacy and we are so thankful for them returning year after year. #cc14

CactusCon's tweet image. CactusCon happens every year thanks to great people, talks, and sponsors.

We are happy to welcome back the @eff as a community sponsor! You know love them as one of the leading voices in digital liberty advocacy and we are so thankful for them returning year after year.

#cc14

Join us TODAY folks! See you soon!

🤔 What’s the 1st thing you should do when #Ransomware hits? It’s not always obvious & making the wrong move can be costly. @rj_chap & @maridegrazia welcome Eric Taylor to talk through the good, the bad, & the ugly of containment. ⏰ Set your reminder: buff.ly/uMIcp6Z

sansforensics's tweet image. 🤔 What’s the 1st thing you should do when #Ransomware hits? It’s not always obvious & making the wrong move can be costly.

@rj_chap &  @maridegrazia welcome Eric Taylor to talk through the good, the bad, & the ugly of containment.

⏰ Set your reminder: buff.ly/uMIcp6Z


Ryan "Chaps" Chapman reposteó

Active Directory hardening is free…outside of your time. Overall - PingCastle Passwords - FGPP, LAPS, Lithnet Permissions - ADeleg/ADeleginator Applocker - Applocker Inspector/Applocker gen ADCS - Locksmith Logon scripts - ScriptSentry GPO - GPOZaurr Baselines - CIS/Microsoft…


Ryan "Chaps" Chapman reposteó

If you hold CTRL, then it will pause Task Manager so the processes don't move around when you're sorted by resource usage

what’s a windows trick you learned way too late?



Join us!!

😬 #Ransomware doesn’t knock, it kicks the door down 🔥 Join @rj_chap, @maridegrazia & guest Eric Taylor as they unpack ransomware containment, rapid response, & the technical steps you need to minimize damage. ⏰ Set your reminder: buff.ly/O0fivpt #DFIR #Cybersecurity

sansforensics's tweet image. 😬 #Ransomware doesn’t knock, it kicks the door down

🔥 Join @rj_chap, @maridegrazia & guest Eric Taylor as they unpack ransomware containment, rapid response, & the technical steps you need to minimize damage.

⏰ Set your reminder: buff.ly/O0fivpt

#DFIR #Cybersecurity


Ryan "Chaps" Chapman reposteó

Big news! Someone finally noticed that if you hold down CTRL, the process list in Task Manager conveniently freezes so you can select rows without them jumping around. I did this so you could sort by CPU and other dynamic columns but then still be able to click stuff...

davepl1968's tweet image. Big news!  Someone finally noticed that if you hold down CTRL, the process list in Task Manager conveniently freezes so you can select rows without them jumping around.

I did this so you could sort by CPU and other dynamic columns but then still be able to click stuff...

Ryan "Chaps" Chapman reposteó

🌴 Join @EricRZimmerman at #DFIRCON for Mastering Investigations with #EZTools. You'll explore tools like KAPE, RECmd, & ShellBags Explorer to take your skills to the next level. 🔗 Learn more about DFIRCON & Community Learning Day: sans.org/u/1CRS 🚨 In-person only

sansforensics's tweet image. 🌴 Join @EricRZimmerman at #DFIRCON for Mastering Investigations with #EZTools. You'll explore tools like KAPE, RECmd, & ShellBags Explorer to take your skills to the next level.

🔗 Learn more about DFIRCON & Community Learning Day: sans.org/u/1CRS 
🚨 In-person only

Sigh. Another one.

Clickfix New instructions !!!!!!! 128[.140.70.83[:8080

solostalking's tweet image. Clickfix 
New instructions !!!!!!!
128[.140.70.83[:8080


Ryan "Chaps" Chapman reposteó

If you're interested by an alternative way to dump domain users' NT hashes and TGT without touching LSASS, take a look at the new Masky tool :) Everything is explained in this article: z4ksec.github.io/posts/masky-re… Thanks @harmj0y, @tifkin_ and @ly4k_ for their amazing work on ADCS!


Ryan "Chaps" Chapman reposteó

📣 Nominations close this Monday at 11:59 p.m. EDT (UTC-4) for #SANSDMA 2025! Don't miss this chance to shine a light on the #cybersecurity practitioners who are making breakthroughs every day in advancing security. ➡️ Nominate Now: sansurl.com/dma-nominate

sansforensics's tweet image. 📣  Nominations close this Monday at 11:59 p.m. EDT (UTC-4) for #SANSDMA 2025! 

Don't miss this chance to shine a light on the #cybersecurity practitioners who are making breakthroughs every day in advancing security.

➡️ Nominate Now: sansurl.com/dma-nominate

Say hello to the most recent @sansforensics FOR610: Reverse Engineering Malware "Lethal Forensicator" challenge coin winners! This group performed wonderfully and secured coins on behalf of the Kingdom! Great job all!

rj_chap's tweet image. Say hello to the most recent @sansforensics FOR610: Reverse Engineering Malware "Lethal Forensicator" challenge coin winners! This group performed wonderfully and secured coins on behalf of the Kingdom! Great job all!

Don't sleep on this man!! HIGHLY experienced. :)

🚨 Open to work — AI Security/ red team / adversary sim 8+ yrs in offensive sec, ex-Cobalt Strike, SANS instructor (12 w/y) Looking for flexible, senior/principal roles w/ impact > hours DMs open or connect via: linkedin.com/in/jean-franco…



Go go go!

🥳 IT BEGINS 🥳 The CactusCon 14 CFP is now OPEN! sessionize.com/cactuscon-14/ Theme is an oldie but a goodie, regardless as usual we are looking for those juicy technical talks that make CactusCon great. #cc14



Fantastic con for your next talk. Check it out!

Can you feel it in the air? That strange pull to dive a deeper into that awesome thing... and the call of an audience hungry for your hard-earned insights. That's right, the CactusCon 14 CFP will open on SEPTEMBER 6TH. We'll share all the links and deadlines on Saturday!



GREAT con to sponsor and overall be a part of! Check them out!

We love organizing a conference of passionate cybersecurity people, and if your company would love to connect with our community and support our conference we would love to have you! Please see our prospectus: cactuscon.com/prospectus And get in touch: [email protected]!



Ryan "Chaps" Chapman reposteó

Domain Admin shouldn’t logon to workstations. Here’s one way to restrict DA logins to workstations: Create a GPO… Computer Config → Windows Settings → Security Settings → Local Policies → User Rights Assignment → ‘Deny log on locally’ & ‘Deny log on through RDP’ → add…


Ryan "Chaps" Chapman reposteó

"Not all heroes wear capes. Some have YouTube channels." .... hot DAAYUUMM CONGRATULATIONS @ScammerPayback !!!!!! 🤩💥🔥🥳🎊🎉 justice.gov/usao-sdca/pr/y…


Ryan "Chaps" Chapman reposteó

Catch up on the latest insights from this year's SANS #DFIRSummit. Stream the full playlist now! 📺 youtube.com/playlist?list=…


Ryan "Chaps" Chapman reposteó

🚨LAST CALL to submit your #DFIR tool! 🛠️ Submissions for the #EZTool Challenge closes today. @EricRZimmerman is standing by to build the winning idea. 💥 Want to shape the future of DFIR #OpenSource tooling? Learn more here: sans.org/u/1Cso

sansforensics's tweet image. 🚨LAST CALL to submit your #DFIR tool!

🛠️ Submissions for the #EZTool Challenge closes today. @EricRZimmerman is standing by to build the winning idea.

💥 Want to shape the future of DFIR #OpenSource tooling? Learn more here: sans.org/u/1Cso

Loading...

Something went wrong.


Something went wrong.