Start Covering Your Bases And Stop Chasing APT Headlines
summary
Claims that old admin tools matter more than flashy zero days and demonstrates a full ransomware-style chain: phishing Word macro → PowerShell reverse shell → download of mimikatz and PSExec and LOLBins → credential dump → lateral movement → scheduled‑task persistence → exfiltration with rclone to Mega. Presents counts from analyses (PSExec in 7 of 19 breaches, mimikatz in 5 of 19) and a live demo that works with defenses disabled, so mitigation focuses on segmentation, network controls and detecting living‑off‑the‑land use.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:33PSExec vs flashy tools
- 3:59CVEs to attack patterns
- 9:07Classic attack archetype
- 10:34Demo setup
- 12:19Social engineering
- 15:40Tool transfer & recon
- 19:15Discovery phase
- 21:52Credential dumping
- 25:10Lateral movement
- 30:56Exfiltration via cloud
- 34:54Post-attack discussion
- 35:59Mitigation strategies
- 40:12Defense in depth
- 41:16Q&A
related talks
52mStart covering your bases & Stop chasing APT headlines
52mRansomware 101: Get Smart Understanding Real Attacks
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
52mRansomware; The Real Pandemic