FOR528 teaches students how to deal with the specifics of ransomware in order to prepare for, detect, hunt, response to, and deal with the aftermath of ransomware. The class includes multiple hunting methods, a hands-on approach to learning using real-world data, and a full-day CTF-style capstone to help students solidify their learning | SANS