E14 Hunting BlackSuit TTPs

In this episode, we talk about hunting BlackSuit ransomware with Scott Poley, Sr Threat Hunter at Intel471. BlackSuit ransomware gang is a rebrand of Royal and the ransomware operator is also believed to be from the now shutdown Conti group.
The conversation also higlights the possible hunt outcomes that help in augmenting the security posture of an organization. Scott also touched upon automation and what phases of a threat hunt could be automated.