Talks

Hacks

Bug Bounty

Cyberrange

Caused critical events in the banking system

The Wolf of Wall Street

Investigated an APT attack at the Standoff Defend cyberrange

APT investigator

Standoff 15 attacker

Autumn 2024 International Cybersecurity Games champion

Reconnaissance

Gather Victim Identity Information

Gather Victim Identity Information: Credentials

Gather Victim Identity Information: Email Addresses

Gather Victim Identity Information: Employee Names

Gather Victim Network Information

Gather Victim Network Information: Domain Properties

Gather Victim Network Information: DNS

Gather Victim Network Information: Network Trust Dependencies

Gather Victim Network Information: Network Topology

Gather Victim Network Information: IP Addresses

Gather Victim Network Information: Network Security Appliances

Gather Victim Org Information

Gather Victim Org Information: Determine Physical Locations

Gather Victim Org Information: Business Relationships

Gather Victim Org Information: Identify Business Tempo

Gather Victim Org Information: Identify Roles

Gather Victim Host Information

Gather Victim Host Information: Hardware

Gather Victim Host Information: Software

Gather Victim Host Information: Firmware

Gather Victim Host Information: Client Configurations

Search Open Websites/Domains

Search Open Websites/Domains: Social Media

Search Open Websites/Domains: Search Engines

Search Open Websites/Domains: Code Repositories

Search Victim-Owned Websites

Active Scanning

Active Scanning: Scanning IP Blocks

Active Scanning: Vulnerability Scanning

Active Scanning: Wordlist Scanning

Search Open Technical Databases

Search Open Technical Databases: DNS/Passive DNS

Search Open Technical Databases: WHOIS

Search Open Technical Databases: Digital Certificates

Search Open Technical Databases: CDNs

Search Open Technical Databases: Scan Databases

Search Closed Sources

Search Closed Sources: Threat Intel Vendors

Search Closed Sources: Purchase Technical Data

Phishing for Information

Phishing for Information: Spearphishing Service

Phishing for Information: Spearphishing Attachment

Phishing for Information: Spearphishing Link

Phishing for Information: Spearphishing Voice

Resource Development

Acquire Infrastructure

Acquire Infrastructure: Domains

Acquire Infrastructure: DNS Server

Acquire Infrastructure: Virtual Private Server

Acquire Infrastructure: Server

Acquire Infrastructure: Botnet

Acquire Infrastructure: Web Services

Acquire Infrastructure: Serverless

Acquire Infrastructure: Malvertising

Compromise Infrastructure

Compromise Infrastructure: Domains

Compromise Infrastructure: DNS Server

Compromise Infrastructure: Virtual Private Server

Compromise Infrastructure: Server

Compromise Infrastructure: Botnet

Compromise Infrastructure: Web Services

Compromise Infrastructure: Serverless

Compromise Infrastructure: Network Devices

Establish Accounts

Establish Accounts: Social Media Accounts

Establish Accounts: Email Accounts

Establish Accounts: Cloud Accounts

Compromise Accounts

Compromise Accounts: Social Media Accounts

Compromise Accounts: Email Accounts

Compromise Accounts: Cloud Accounts

Develop Capabilities

Develop Capabilities: Malware

Develop Capabilities: Code Signing Certificates

Develop Capabilities: Digital Certificates

Develop Capabilities: Exploits

Obtain Capabilities

Obtain Capabilities: Malware

Obtain Capabilities: Tool

Obtain Capabilities: Code Signing Certificates

Obtain Capabilities: Digital Certificates

Obtain Capabilities: Exploits

Obtain Capabilities: Vulnerabilities

Obtain Capabilities: Artificial Intelligence

Stage Capabilities

Stage Capabilities: Upload Malware

Stage Capabilities: Upload Tool

Stage Capabilities: Install Digital Certificate

Stage Capabilities: Drive-by Target

Stage Capabilities: Link Target

Stage Capabilities: SEO Poisoning

Acquire Access

Initial Access

Valid Accounts

Valid Accounts: Default Accounts

Valid Accounts: Domain Accounts

Valid Accounts: Local Accounts

Valid Accounts: Cloud Accounts

Replication Through Removable Media

External Remote Services

Drive-by Compromise

Exploit Public-Facing Application

Supply Chain Compromise

Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Supply Chain Compromise: Compromise Software Supply Chain

Supply Chain Compromise: Compromise Hardware Supply Chain

Trusted Relationship

Hardware Additions

Phishing

Phishing: Spearphishing Attachment

Phishing: Spearphishing Link

Phishing: Spearphishing via Service

Phishing: Spearphishing Voice

Content Injection

Execution

Windows Management Instrumentation

Scheduled Task/Job

Scheduled Task/Job: At

Scheduled Task/Job: Cron

Scheduled Task/Job: Scheduled Task

Scheduled Task/Job: Systemd Timers

Scheduled Task/Job: Container Orchestration Job

Command and Scripting Interpreter

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: AppleScript

Command and Scripting Interpreter: Windows Command Shell

Command and Scripting Interpreter: Unix Shell

Command and Scripting Interpreter: Visual Basic

Command and Scripting Interpreter: Python

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: Network Device CLI

Command and Scripting Interpreter: Cloud API

Command and Scripting Interpreter: AutoHotKey & AutoIT

Command and Scripting Interpreter: Lua

Software Deployment Tools

Native API

Shared Modules

Exploitation for Client Execution

User Execution

User Execution: Malicious Link

User Execution: Malicious File

User Execution: Malicious Image

Inter-Process Communication

Inter-Process Communication: Component Object Model

Inter-Process Communication: Dynamic Data Exchange

Inter-Process Communication: XPC Services

System Services

System Services: Launchctl

System Services: Service Execution

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Persistence

Boot or Logon Initialization Scripts

Boot or Logon Initialization Scripts: Logon Script (Windows)

Boot or Logon Initialization Scripts: Login Hook

Boot or Logon Initialization Scripts: Network Logon Script

Boot or Logon Initialization Scripts: RC Scripts

Boot or Logon Initialization Scripts: Startup Items

Account Manipulation

Account Manipulation: Additional Cloud Credentials

Account Manipulation: Additional Email Delegate Permissions

Account Manipulation: Additional Cloud Roles

Account Manipulation: SSH Authorized Keys

Account Manipulation: Device Registration

Account Manipulation: Additional Container Cluster Roles

Account Manipulation: Additional Local or Domain Groups

Create Account

Create Account: Local Account

Create Account: Domain Account

Create Account: Cloud Account

Office Application Startup

Office Application Startup: Office Template Macros

Office Application Startup: Office Test

Office Application Startup: Outlook Forms

Office Application Startup: Outlook Home Page

Office Application Startup: Outlook Rules

Office Application Startup: Add-ins

Browser Extensions

BITS Jobs

Traffic Signaling

Traffic Signaling: Port Knocking

Traffic Signaling: Socket Filters

Server Software Component

Server Software Component: SQL Stored Procedures

Server Software Component: Transport Agent

Server Software Component: Web Shell

Server Software Component: IIS Components

Server Software Component: Terminal Services DLL

Leofun