Being A Better Defender By Channeling Your Worst Adversary:
summary
Built repeatable adversary emulations aimed at improving detection rather than prevention, mapping sequences to MITRE ATT&CK and delivering time-stamped command logs for validation. Uses PowerShell Empire to Covenant for C2, Metasploit when Cobalt Strike isn’t available, Sysmon and osquery for telemetry, and AWS/Azure/GCP with Azure AD/AD Connect and ADFS to exercise NTDS.DIT via volume shadow copies and Golden SAML scenarios. Runs SQL Azure auditing, uncovers cloud auditing gaps found, and when FTP exfil fails, proves a DNS exfil fallback works.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:05Adversary Emulation
- 1:37Identifying the Blind Spots
- 2:16Adversary Development
- 6:43Diamond Model
- 7:11Identify Goals
- 8:48Metasploit
- 10:53Miter Attack Techniques
- 16:22Adfs Active Directory Federation Services
- 18:28Intrusion Vectors
- 19:18Maintaining a Light Footprint
- 21:31Lessons Learned
- 29:14Character Development
- 30:33Last Thoughts
- 30:55Risk of Diminishing Returns
- 31:31Last Thoughts Focus on the Goals
related talks
40mAdversary Simulation: Close the Gaps in Your Security Posture
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
43mBecoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
52mStart covering your bases & Stop chasing APT headlines
41mSimulation Hacking, the Good, Bad and the Ugly
52mCALDERA: Automating Adversary Emulation