Notes from SANS Stay Ahead of Ransomware Livestream April 2026 episode :)

1. Suggestion: Trim & strip escape characters
   • Suggest trimming + stripping escape characters and other DOSfuscation-type characters to maximize your string-based queries and avoid falling for escape character pitfalls
   • Use trim or ltrim|rtrim depending on your E/XDR

| make_a_new_field_for_me registry_data = replace(registry_data, "\"", "")

This document serves to provide resources to help Prevent, Detect, and Respond to MS Teams-based Initial Access, with a heavy focus on MS Teams > RMM/QuickAssist attacks.

• IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities
• Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID
• Guess Access in Teams