rj-chap

Local Communities

1. Check for your local BSides communities

• https://bsides.org/chapters/

2. Check Meetup[.]com and look for local groups

• https://www.meetup.com/

Discord Community Lists

rj-chap

Tips and tricks for hunting ClickFix

Notes from SANS Stay Ahead of Ransomware Livestream April 2026 episode :)

1. Suggestion: Trim & strip escape characters
   • Suggest trimming + stripping escape characters and other DOSfuscation-type characters to maximize your string-based queries and avoid falling for escape character pitfalls
   • Use trim or ltrim|rtrim depending on your E/XDR

| make_a_new_field_for_me registry_data = replace(registry_data, "\"", "")

rj-chap

This document serves to provide resources to help Prevent, Detect, and Respond to MS Teams-based Initial Access, with a heavy focus on MS Teams > RMM/QuickAssist attacks.

Teams

Restricting 3rd Party Access

• IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities
• Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID
• Guess Access in Teams

rj-chap

### Keybase proof

I hereby claim:

  * I am rj-chap on github.
  * I am rj_chap (https://keybase.io/rj_chap) on keybase.
  * I have a public key whose fingerprint is 4657 AA40 EDE1 B84C 6967  F9EF 2CDD E955 0AC6 BC26

To claim this, I am signing this object:

rj-chap

### Keybase proof

I hereby claim:

  * I am rj-chap on github.
  * I am rj_chap (https://keybase.io/rj_chap) on keybase.
  * I have a public key whose fingerprint is 941B 86C4 4007 0D47 ADBD  15D4 5A95 1B09 3A44 A043

To claim this, I am signing this object: