|
Conference Talk |
DEFCON 30 |
https://forum.defcon.org/node/242211 |
Less SmartScreen More Caffeine – ClickOnce (Ab)Use for Trusted Code... |
|
|
08/14/22 |
Steven Flores & Nick Powers |
|
Tool Demo |
DEFCON 30 DemoLabs |
https://forum.defcon.org/node/242260 |
SharpSCCM |
https://github.com/Mayyhem/SharpSCCM/blob/main/SharpSCCM%20-%20BHUSA%2BDefcon%202022.pptx |
|
08/13/22 |
Chris Thompson & Duane Michael |
|
Tool Demo |
Black Hat USA Arsenal |
https://www.blackhat.com/us-22/arsenal/schedule/index.html#sharpsccm-27886 |
SharpSCCM |
https://github.com/Mayyhem/SharpSCCM/blob/main/SharpSCCM%20-%20BHUSA%2BDefcon%202022.pptx |
|
08/11/22 |
Chris Thompson & Duane Michael |
|
Tool Demo |
Black Hat USA Arsenal |
https://www.blackhat.com/us-22/arsenal/schedule/index.html#ghostwriter-28067 |
Ghostwriter |
|
|
08/11/22 |
Christopher Maddalena |
|
Conference Talk |
BSides Seattle |
|
FreeIPA - Attacking the Active Directory of Linux |
https://www2.slideshare.net/JulianCatrambone/freeipa-attacking-the-active-directory-of-linux |
|
10/17/20 |
Julian Catrambone |
|
Conference Talk |
Reversing 2020 |
|
How Not to Shoot yourself in the Foot with Patterns |
|
https://www.youtube.com/watch?v=jHVkXxeSq-k |
6/30/20 |
Jo Johnson |
|
Conference Talk |
Objective By the Sea |
https://objectivebythesea.com/v3/content.html |
Walking the Bifrost: An Operator's Guide to Heimdal & Kerberos on macOS |
https://www2.slideshare.net/CodyThomas6/walking-the-bifrost-an-operators-guide-to-heimdal-kerberos-on-macos |
|
3/12/20 |
Cody Thomas |
|
Conference Talk |
HushCon Seattle 2019 |
|
Understanding Windows Access Token Manipulation |
https://www.slideshare.net/JustinBui5/understanding-windows-access-token-manipulation |
|
12/7/19 |
Justin Bui |
|
Conference Talk |
DerbyCon 9.0 |
|
Waking up the data engineer in you! |
|
https://www.youtube.com/watch?v=LBgBGWPJLKo |
9/8/19 |
Jared Atkinson |
|
Conference Talk |
DerbyCon 9.0 |
|
Kerberoasting Revisited |
https://www2.slideshare.net/harmj0y/derbycon-2019-kerberoasting-revisited |
https://www.youtube.com/watch?v=yrMGRhyoyGs |
9/7/19 |
Will Schroeder |
|
Conference Talk |
DerbyCon 9.0 |
|
Practical Heuristic Exploitation |
|
https://www.youtube.com/watch?v=1fVmsp9_1BY |
9/7/19 |
Kelly Villanueva |
|
Conference Talk |
DerbyCon 9.0 |
|
Not A Security Boundary: Breaking Forest Trusts |
https://www2.slideshare.net/harmj0y/not-a-security-boundary |
https://www.youtube.com/watch?v=UD3ubiMeoco |
9/6/19 |
Lee Christensen & Will Schroeder |
|
Conference Talk |
DerbyCon 9.0 |
|
How do I detect technique X in Windows? Applied Methodology to Definitively Answer this Question |
|
https://www.youtube.com/watch?v=GVRIUsgrwSQ |
9/6/19 |
Matt Graeber |
|
Conference Talk |
BlackHat USA 2019 |
https://www.blackhat.com/us-19/briefings/schedule/index.html#finding-our-path-how-were-trying-to-improve-active-directory-security-17075 |
Finding Our Path: How We're Trying to Improve Active Directory Security |
|
|
8/8/19 |
Andy Robbins & Rohan Vazarkar & Will Schroeder |
|
Conference Talk |
Objective By the Sea |
https://objectivebythesea.com/v2/talks.html |
Bash-ing Brittle Indicators: Red Teaming macOS without Bash or Python |
https://www2.slideshare.net/CodyThomas6/bashing-brittle-indicators-red-teaming-macos-without-bash-or-python |
https://www.youtube.com/watch?v=E-QEsGsq3uI&list=PLliknDIoYszvTDaWyTh6SYiTccmwOsws8&index=16 |
6/1/19 |
Cody Thomas |
|
Conference Talk |
TROOPERS19 |
https://troopers.de/troopers19/agenda/stxeyg/ |
Not A Security Boundary: Breaking Forest Trusts |
https://troopers.de/downloads/troopers19/TROOPERS19_AD_not_a_security_boundary.pdf |
https://www.youtube.com/watch?v=YmzfWHiXNZ8 |
3/21/19 |
Lee Christensen & Will Schroeder |
|
Conference Talk |
BSides Seattle |
http://www.securitybsides.com/w/page/129078930/BsidesSeattle2019 |
Ready Player 2: Multiplayer Red Teaming Against macOS |
https://www2.slideshare.net/CodyThomas6/ready-player-2-multiplayer-red-teaming-against-macos |
|
2/24/19 |
Cody Thomas |
|
Conference Talk |
DerbyCon 8.0 |
|
The Unintended Risks of Trusting Active Directory |
https://www.slideshare.net/harmj0y/derbycon-the-unintended-risks-of-trusting-active-directory |
https://www.youtube.com/watch?v=-bcWZQCLk_4 |
10/5/18 |
Will Schroeder & Lee Christensen & Matt Nelson |
|
Conference Talk |
DerbyCon 8.0 |
|
A Process is No One: Hunting for Token Manipulation |
|
https://www.youtube.com/watch?v=I4Y500O9GeQ |
10/5/18 |
Jared Atkinson & Robby Winchester |
|
Conference Talk |
DerbyCon 8.0 |
|
When Macs Come Under ATTCK |
|
https://www.youtube.com/watch?v=iweEI60PWeY |
10/5/18 |
Richie Cyrus |
|
Conference Talk |
SANS Threat Hunting Summit |
https://content.sans.org/sites/default/files/2018-05/Agenda%20THIR_1.pdf |
ATT&Cking the Status Quo: Threat-Based Adversary Emulation with MITRE ATT&CK |
https://www2.slideshare.net/KatieNickels/threatbased-adversary-emulation-with-mitre-attck |
|
9/6/18 |
Cody Thomas & Katie Nickels |
|
Conference Talk |
BlackHat USA 2018 |
https://www.blackhat.com/us-18/briefings/schedule/index.html#subverting-sysmon-application-of-a-formalized-security-product-evasion-methodology-9982 |
Subverting Sysmon: Application of a Formalized Security Product Evasion Methodology |
https://i.blackhat.com/us-18/Wed-August-8/us-18-Graeber-Subverting-Sysmon-Application-Of-A-Formalized-Security-Product-Evasion-Methodology.pdf |
|
8/8/18 |
Matt Graeber & Lee Christensen |
|
Conference Talk |
The Circle of HOPE |
https://xii.hope.net/speakers.html |
ATT&CKing with Threat Intelligence |
https://www2.slideshare.net/ChristopherKorban/attcking-with-threat-intelligence |
https://www.youtube.com/watch?v=048kJTZmjj4 |
7/20/18 |
Cody Thomas & Chris Korban |
|
Conference Talk |
x33fcon |
https://www.x33fcon.com/#!archive/2018/s/atak.md |
Threat-based Purple Teaming with ATT&CK |
https://www2.slideshare.net/ChristopherKorban/purple-teaming-with-attck-x33fcon-2018 |
https://www.youtube.com/watch?v=OYEP-YAKIn0&list=PL7ZDZo2Xu332XUiwFHB5X-tXfqIwVkg5l&index=2 |
5/7/18 |
Cody Thomas & Chris Korban |
|
Conference Talk |
PSConfEU |
https://psconf.eu/2018/index.html |
Working with Binary Data: Writing your own parser |
|
|
4/19/18 |
Jared Atkinson |
|
Conference Talk |
PSConfEU |
https://psconf.eu/2018/index.html |
Auditing Domain Trust Relationships |
|
|
4/19/18 |
Will Schroeder |
|
Conference Talk |
PSConfEU |
https://psconf.eu/2018/index.html |
The Power of the Dark Side: Offensive PowerShell Workshop |
https://github.com/psconfeu/2018/tree/master/Workshops/Offensive%20PowerShell%20Workshop |
|
4/18/18 |
Will Schroeder & Jared Atkinson |
|
Conference Talk |
PSConfEU |
https://psconf.eu/2018/index.html |
PowerShell, Reflection, and the Windows API |
|
|
4/18/18 |
Jared Atkinson |
|
Conference Talk |
Sp4rkCon 2.0 |
|
The Unintended Risks of Trusting Active Directory |
https://www.slideshare.net/harmj0y/the-unintended-risks-of-trusting-active-directory |
|
4/7/18 |
Will Schroeder & Lee Christensen & Matt Nelson |
|
Conference Talk |
TROOPERS18 |
https://troopers.de/troopers18/agenda/vhrnj3/ |
Subverting Trust in Windows |
|
https://www.youtube.com/watch?v=LpsrJOGRU8w |
3/15/18 |
Matt Graeber |
| 2018/02/21 10:49:13 AM EST |
Conference Talk |
BlueHat Israel 2018 |
http://www.bluehatil.com/abstracts.html?abs=10#10 |
Hi, My Name is "CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" |
http://www.bluehatil.com/files/Matt%20Graeber%20BlueHat%20IL%202018.pdf |
https://youtu.be/I3jCGBzMmzw |
1/24/18 |
Matt Graeber |
| 2018/02/26 2:55:15 PM EST |
Conference Talk |
BlackHat Europe 17 |
https://www.blackhat.com/eu-17/briefings.html#a-process-is-no-one-hunting-for-token-manipulation |
A Process is No One: Hunting for Token Manipulation |
https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf |
|
12/7/17 |
Jared Atkinson & Robby Winchester |
| 2018/02/21 9:58:44 AM EST |
Conference Talk |
BlueHat 2017 |
https://blogs.technet.microsoft.com/bluehat/2017/09/01/announcing-the-bluehat-v17-schedule/ |
_____ Is Not a Security Boundary: Things I Have Learned and Things That Have Gotten Better from Researching Microsoft Software |
https://www.slideshare.net/enigma0x3/is-not-a-security-boundary-things-i-have-learned-and-things-that-have-gotten-better-from-researching-microsoft-software |
|
11/10/17 |
Matt Nelson |
|
Conference Talk |
Fal.Con 2017 |
https://www.crowdstrike.com/falcon2017/sessions.html |
Subverting & Restoring Trust in Windows |
|
|
11/7/17 |
Matt Graeber |
| 2018/02/21 9:56:38 AM EST |
Conference Talk |
Wild West Hacking Fest |
https://wildwesthackinfest2017.sched.com/event/B1cZ/windows-operating-system-archaeology |
Windows Operating System Archaeology |
https://onedrive.live.com/view.aspx?cid=b9e47855f9345d3b&page=view&resid=B9E47855F9345D3B!752&parId=B9E47855F9345D3B!750&authkey=!AFyjSoMP5Z2Q6b4&app=PowerPoint |
https://www.youtube.com/watch?v=fo4I-EPNYE4 |
10/27/17 |
Matt Nelson & Casey Smith |
| 2018/02/21 1:35:45 PM EST |
Conference Talk |
ArcticCon 2017 |
https://bluescreenofjeff.com/talks |
Building a Better Moat: Designing an Effective Covert Red Team Attack Infrastructure |
https://speakerdeck.com/bluscreenofjeff/building-a-better-moat-designing-an-effective-covert-red-team-attack-infrastructure |
|
10/25/17 |
Jeff Dimmock |
| 2018/02/26 6:34:12 PM EST |
Conference Talk |
GraphConnect NYC '17 |
http://graphconnect.com/gc2017-ny/ |
How Graphs Changed The Way Hackers Attack |
https://www.slideshare.net/AndyRobbins3/how-graphs-changed-the-way-hackers-attack |
https://www.youtube.com/watch?v=cT4xEhssz0U&feature=youtu.be |
10/25/17 |
Andy Robbins |
| 2018/02/21 10:00:49 AM EST |
Conference Talk |
DerbyCon 7.0 |
https://www.derbycon.com/saturday-schedule/#event-111 |
Not a Security Boundary: Bypassing User Account Control |
https://www.slideshare.net/enigma0x3/not-a-security-boundary-bypassing-user-account-control |
https://www.youtube.com/watch?v=c8LgqtATAnE |
9/24/17 |
Matt Nelson |
| 2018/02/20 6:47:21 PM EST |
Conference Talk |
DerbyCon 7.0 |
https://www.derbycon.com/friday-schedule/#event-33 |
Here Be Dragons: The Unexplored Land of Active Directory ACLs |
https://www.slideshare.net/AndyRobbins3/here-be-dragons-the-unexplored-land-of-active-directory-acls |
https://www.youtube.com/watch?v=z8thoG7gPd0 |
9/22/17 |
Andy Robbins & Rohan Vazarkar & Will Schroeder |
| 2018/02/20 6:48:07 PM EST |
Conference Talk |
DerbyCon 7.0 |
https://www.derbycon.com/friday-schedule/#event-49 |
An ACE in the Hole: Stealthy Host Persistence via Security Descriptors |
https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptors |
https://www.youtube.com/watch?v=ExO535CITXs |
9/22/17 |
Will Schroeder & Lee Christensen & Matt Nelson |
| 2018/02/21 10:46:24 AM EST |
Conference Talk |
DerbyCon 7.0 |
https://www.irongeek.com/i.php?page=videos/derbycon7/k00-subverting-trust-in-windows-a-case-study-of-the-how-and-why-of-engaging-in-security-research-matt-graeber |
Subverting Trust in Windows - A Case Study of the "How" and "Why" of Engaging in Security Research |
https://drive.google.com/file/d/0B-K55rLoulAfNms1aW1rbXF1Tmc/view?usp=sharing |
https://www.youtube.com/watch?v=wxmxxgL6Nz8 |
9/22/17 |
Matt Graeber |
| 2018/02/20 6:46:18 PM EST |
Conference Talk |
DEF CON |
https://www.defcon.org/html/defcon-25/dc-25-speakers.html#Robbins |
An ACE Up The Sleeve: Designing Active Directory DACL Backdoors |
https://www.slideshare.net/harmj0y/ace-up-the-sleeve |
https://www.youtube.com/watch?v=_nGpZ1ydzS8 |
7/28/17 |
Andy Robbins & Will Schroeder |
| 2018/02/26 6:27:51 PM EST |
Conference Talk |
BlackHat USA 2017 |
https://www.blackhat.com/us-17/briefings/schedule/#an-ace-up-the-sleeve-designing-active-directory-dacl-backdoors-6223 |
An ACE Up The Sleeve - Designing Active Directory DACL Backdoors |
https://www.slideshare.net/harmj0y/ace-up-the-sleeve |
https://www.youtube.com/watch?v=ys1LZ1MzIxE&feature=youtu.be |
7/26/17 |
Andy Robbins & Will Schroeder |
| 2018/02/21 1:33:43 PM EST |
Conference Talk |
Hack Miami 5 |
https://bluescreenofjeff.com/talks |
Doomsday Preppers: Fortifying Your Red Team Infrastructure |
https://speakerdeck.com/rvrsh3ll/doomsday-preppers-hackmiami |
|
5/20/17 |
Steve Borosh |
| 2018/02/20 6:43:40 PM EST |
Conference Talk |
Charlotte ISSA Annual Summit |
https://www.charlotteissa.org/ |
Catch Me If You Can: PowerShell Red vs. Blue |
https://www.slideshare.net/harmj0y/catch-me-if-you-can-powershell-red-vs-blue |
|
5/18/17 |
Will Schroeder |
| 2018/02/26 6:24:46 PM EST |
Conference Talk |
Paranoia17 |
https://paranoia.watchcom.no/ |
BloodHound 1.3 - The ACL Attack Paths Update |
https://www.slideshare.net/AndyRobbins3/bloodhound-13-the-acl-attack-path-update-paranoia17-oslo |
|
5/11/17 |
Andy Robbins & Rohan Vazarkar & Will Schroeder |
| 2018/02/20 6:42:53 PM EST |
Conference Talk |
PSConfEU |
http://www.psconf.eu/ |
Defending Your Gold |
https://www.slideshare.net/harmj0y/defending-your-gold |
https://www.youtube.com/watch?v=wuwAUuIHTM8 |
5/4/17 |
Will Schroeder |
|
Conference Talk |
PSConfEU |
http://www.psconf.eu/ |
Flip The Script |
https://github.com/psconfeu/2017/blob/master/Jared%20Atkinson/Flip%20the%20Script/FlipTheScript_Atkinson.pdf |
|
5/4/17 |
Jared Atkinson |
| 2018/02/20 6:42:10 PM EST |
Conference Talk |
PSConfEU |
http://www.psconf.eu/ |
Catch Me If You Can: PowerShell Red vs. Blue |
https://www.slideshare.net/harmj0y/catch-me-if-you-can-powershell-red-vs-blue |
https://www.youtube.com/watch?v=Hhpi3Sp4W4k |
5/3/17 |
Will Schroeder |
|
Conference Talk |
PSConfEU |
http://www.psconf.eu/ |
Porting Binary PowerShell Modules to Linux/OSX |
https://github.com/psconfeu/2017/blob/master/Jared%20Atkinson/Porting%20Binary%20Modules/PortingBinaryModules_Atkinson.pdf |
|
5/3/17 |
Jared Atkinson |
| 2018/02/21 10:21:12 AM EST |
Conference Talk |
OPCDE 2017 |
https://www.opcde.com/pages/speakers/ |
Windows Operating System Archaeology |
https://github.com/comaeio/OPCDE/blob/master/2017/Windows%20Operating%20System%20Archaeology%20-%20Matt%20Nelson/Windows%20Operating%20System%20Archaeology.pdf |
|
4/26/17 |
Matt Nelson & Casey Smith |
| 2018/02/21 10:20:00 AM EST |
Conference Talk |
BSides NashVille |
https://bsidesnash2017.busyconf.com/schedule#activity_584d9746bd77349073000025 |
Windows Operating System Archaeology |
https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology |
http://www.irongeek.com/i.php?page=videos/bsidesnashville2017/bsides-nashville-2017-red01-windows-operating-system-archaeology-casey-smithand-matt-nelson |
4/22/17 |
Matt Nelson & Casey Smith |
| 2018/02/20 6:40:18 PM EST |
Conference Talk |
BSides Nola |
http://www.securitybsides.com/w/page/113990746/BSidesNOLA%202017 |
A Case Study in Attacking KeePass |
https://www.slideshare.net/harmj0y/a-case-study-in-attacking-keepass |
|
4/1/17 |
Will Schroeder & Lee Christensen |
|
Conference Talk |
Bsides NoVA |
https://bsidesnova2017.busyconf.com/schedule#day_580928bf33199418b800012e |
Bro, I Can See You Moving Laterally |
https://securityneversleeps.files.wordpress.com/2017/02/bro-i-can-see-you-moving-laterally.pptx |
https://www.irongeek.com/i.php?page=videos/bsidesnova2017/204-bro-i-can-see-you-moving-laterally-richie-cyrus |
2/25/17 |
Richie Cyrus |