Start covering your bases & Stop chasing APT headlines
summary
End-to-end demo shows a realistic breach: phishing with a macro launches a Python/Powershell hoax shell reverse connection, attacker downloads ADFind, mimikatz and rclone, dumps NTLM hashes, cracks Danny’s hash with John the Ripper to get domain admin credentials, uses PSExec used in 7 of 19 CISA reports to copy evil.exe and create scheduled-task persistence, then uploads sensitive_data.txt to mega.io for exfiltration. Defense wins are concrete: network segmentation, block or monitor PSExec/SMB, and place network tripwires at lateral-movement and exfil stages.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:08Chasing APT headlines is misleading
- 7:26Common attack vector explained
- 13:22Live attack demo setup
- 15:33Initial access via phishing
- 20:15Tool transfer phase
- 25:20Network discovery and privilege mapping
- 27:51Credential dumping and escalation
- 31:30Lateral movement and persistence
- 37:33Data exfiltration via cloud
- 42:16Q&A
- 44:51Key takeaways
- 48:50Defensive strategies
related talks
42mStart Covering Your Bases And Stop Chasing APT Headlines
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
52mRansomware 101: Get Smart Understanding Real Attacks
39mHow to think like a hacker