Fighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
summary
Shows four concrete breach paths and how to detect them: unpatched gateways (Fortinet and exposed RDP/VPN credentials), on‑prem Exchange ProxyLogon, the SolarWinds DLL supply‑chain backdoor affecting 30,000+ Orion customers, and malicious Azure apps that create a Microsoft Graph API service principal to read, modify and exfiltrate SharePoint/OneDrive/mail. Demonstrates PoC abuse of Office macros, details DNS for C2, Active Directory lateral moves, and prescribes telemetry: watch the data itself, enrich logs with roles and sensitivity, apply behavioral analytics and automated forensics to cut time to detection.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:14Gateway Compromise
- 2:50Initial Access
- 5:43Proxy logon
- 7:55Patching
- 13:28Microsoft Graph API
- 17:50Insider Threats
- 21:35Anatomy of Attacks
- 23:11Detecting Attacks
- 25:30Threat Models
- 29:58Alerts
related talks
52mStart covering your bases & Stop chasing APT headlines
42mStart Covering Your Bases And Stop Chasing APT Headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
27mBreach - ATT&CK - Osquery
48mLateral Movement in the Age of Hybrid Cloud
55mAzure Attacks Unpacked: Real-World Threats & Lessons
30mCountering Persistent Threat Actors in APAC and Globally
46mThe 5 Most Dangerous New Attack Techniques and How to Counter Them