Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs, (Wed, May 27th)

Analysis of Akira ransomware attack reconstruction using perimeter firewall and Windows event logs. Focus on early stages of the attack including initial access, privilege escalation to domain admin, and pre-encryption activities. Emphasizes the importance of correlating perimeter and endpoint logs for forensic investigation. Provides insights into defender-focused questions about attack progression before ransomware deployment.