Introduction To Red Team Tooling And Opsec
summary
Red team builds repeatable infrastructure with terraform and ansible, uses Cobalt Strike as C2 and guardrails to avoid accidental runs, then exploits a local DLL search order to perform a Teams DLL hijack for a stealthy beacon. Recon finds an exposed SQL backup, pulls the SA hash, cracks it, uses PowerUpSQL for remote OS commands, abuses certificate templates to escalate, and uses session dumping plus a targeted Alice→Bob social hook to steal SaaS sessions. Attack succeeds but session dumping triggers noisy detections.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 0:45About the speaker
- 1:27Modern red team scenario
- 2:48OSINT and environment setup
- 3:49Guardrails and automation
- 5:15DLL hijacking in Teams
- 6:17Fingerprinting and bypassing AV/EDR
- 7:19Initial access via SQL backup
- 8:21Lateral movement to domain admin
- 9:04SAS solution compromise
- 9:47Blue team detections and improvements
- 10:28Deception technology Q&A
- 11:26Automated red teaming Q&A
related talks
40mFantastic Red-Team Attacks and How to Find Them
49mStories from the trenches - How a red team exercise gained full control of a client network
30mTales of Red Teaming
46mNext Generation Red Teaming
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
35mRed Teaming AWS: Practice What You Preach/
13mFreedom of Security
52mBuilding the Always-On Purple Team