Talks

Hacks

Bug Bounty

Cyberrange

Caused critical events in the banking system

The Wolf of Wall Street

Reconnaissance

Gather Victim Identity Information

Gather Victim Identity Information: Credentials

Gather Victim Identity Information: Email Addresses

Gather Victim Identity Information: Employee Names

Gather Victim Network Information

Gather Victim Network Information: Domain Properties

Gather Victim Network Information: DNS

Gather Victim Network Information: Network Trust Dependencies

Gather Victim Network Information: Network Topology

Gather Victim Network Information: IP Addresses

Gather Victim Network Information: Network Security Appliances

Gather Victim Org Information

Gather Victim Org Information: Determine Physical Locations

Gather Victim Org Information: Business Relationships

Gather Victim Org Information: Identify Business Tempo

Gather Victim Org Information: Identify Roles

Gather Victim Host Information

Gather Victim Host Information: Hardware

Gather Victim Host Information: Software

Gather Victim Host Information: Firmware

Gather Victim Host Information: Client Configurations

Search Open Websites/Domains

Search Open Websites/Domains: Social Media

Search Open Websites/Domains: Search Engines

Search Open Websites/Domains: Code Repositories

Search Victim-Owned Websites

Active Scanning

Active Scanning: Scanning IP Blocks

Active Scanning: Vulnerability Scanning

Active Scanning: Wordlist Scanning

Search Open Technical Databases

Search Open Technical Databases: DNS/Passive DNS

Search Open Technical Databases: WHOIS

Search Open Technical Databases: Digital Certificates

Search Open Technical Databases: CDNs

Search Open Technical Databases: Scan Databases

Search Closed Sources

Search Closed Sources: Threat Intel Vendors

Search Closed Sources: Purchase Technical Data

Phishing for Information

Phishing for Information: Spearphishing Service

Phishing for Information: Spearphishing Attachment

Phishing for Information: Spearphishing Link

Phishing for Information: Spearphishing Voice

Resource Development

Acquire Infrastructure

Acquire Infrastructure: Domains

Acquire Infrastructure: DNS Server

Acquire Infrastructure: Virtual Private Server

Acquire Infrastructure: Server

Acquire Infrastructure: Botnet

Acquire Infrastructure: Web Services

Acquire Infrastructure: Serverless

Acquire Infrastructure: Malvertising

Compromise Infrastructure

Compromise Infrastructure: Domains

Compromise Infrastructure: DNS Server

Compromise Infrastructure: Virtual Private Server

Compromise Infrastructure: Server

Compromise Infrastructure: Botnet

Compromise Infrastructure: Web Services

Compromise Infrastructure: Serverless

Compromise Infrastructure: Network Devices

Establish Accounts

Establish Accounts: Social Media Accounts

Establish Accounts: Email Accounts

Establish Accounts: Cloud Accounts

Compromise Accounts

Compromise Accounts: Social Media Accounts

Compromise Accounts: Email Accounts

Compromise Accounts: Cloud Accounts

Develop Capabilities

Develop Capabilities: Malware

Develop Capabilities: Code Signing Certificates

Develop Capabilities: Digital Certificates

Develop Capabilities: Exploits

Obtain Capabilities

Obtain Capabilities: Malware

Obtain Capabilities: Tool

Obtain Capabilities: Code Signing Certificates

Obtain Capabilities: Digital Certificates

Obtain Capabilities: Exploits

Obtain Capabilities: Vulnerabilities

Obtain Capabilities: Artificial Intelligence

Stage Capabilities

Stage Capabilities: Upload Malware

Stage Capabilities: Upload Tool

Stage Capabilities: Install Digital Certificate

Stage Capabilities: Drive-by Target

Stage Capabilities: Link Target

Stage Capabilities: SEO Poisoning

Acquire Access

Initial Access

Valid Accounts

Valid Accounts: Default Accounts

Valid Accounts: Domain Accounts

Valid Accounts: Local Accounts

Valid Accounts: Cloud Accounts

Replication Through Removable Media

External Remote Services

Drive-by Compromise

Exploit Public-Facing Application

Supply Chain Compromise

Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Supply Chain Compromise: Compromise Software Supply Chain

Supply Chain Compromise: Compromise Hardware Supply Chain

Trusted Relationship

Hardware Additions

Phishing

Phishing: Spearphishing Attachment

Phishing: Spearphishing Link

Phishing: Spearphishing via Service

Phishing: Spearphishing Voice

Content Injection

Execution

Windows Management Instrumentation

Scheduled Task/Job

Scheduled Task/Job: At

Scheduled Task/Job: Cron

Scheduled Task/Job: Scheduled Task

Scheduled Task/Job: Systemd Timers

Scheduled Task/Job: Container Orchestration Job

Command and Scripting Interpreter

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: AppleScript

Command and Scripting Interpreter: Windows Command Shell

Command and Scripting Interpreter: Unix Shell

Command and Scripting Interpreter: Visual Basic

Command and Scripting Interpreter: Python

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: Network Device CLI

Command and Scripting Interpreter: Cloud API

Command and Scripting Interpreter: AutoHotKey & AutoIT

Command and Scripting Interpreter: Lua

Software Deployment Tools

Native API

Shared Modules

Exploitation for Client Execution

User Execution

User Execution: Malicious Link

User Execution: Malicious File

User Execution: Malicious Image

Inter-Process Communication

Inter-Process Communication: Component Object Model

Inter-Process Communication: Dynamic Data Exchange

Inter-Process Communication: XPC Services

System Services

System Services: Launchctl

System Services: Service Execution

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Persistence

Boot or Logon Initialization Scripts

Boot or Logon Initialization Scripts: Logon Script (Windows)

Boot or Logon Initialization Scripts: Login Hook

Boot or Logon Initialization Scripts: Network Logon Script

Boot or Logon Initialization Scripts: RC Scripts

Boot or Logon Initialization Scripts: Startup Items

Account Manipulation

Account Manipulation: Additional Cloud Credentials

Account Manipulation: Additional Email Delegate Permissions

Account Manipulation: Additional Cloud Roles

Account Manipulation: SSH Authorized Keys

Account Manipulation: Device Registration

Account Manipulation: Additional Container Cluster Roles

Account Manipulation: Additional Local or Domain Groups

Create Account

Create Account: Local Account

Create Account: Domain Account

Create Account: Cloud Account

Office Application Startup

Office Application Startup: Office Template Macros

Office Application Startup: Office Test

Office Application Startup: Outlook Forms

Office Application Startup: Outlook Home Page

Office Application Startup: Outlook Rules

Office Application Startup: Add-ins

Browser Extensions

BITS Jobs

Traffic Signaling

Traffic Signaling: Port Knocking

Traffic Signaling: Socket Filters

Server Software Component

Server Software Component: SQL Stored Procedures

Server Software Component: Transport Agent

Server Software Component: Web Shell

Server Software Component: IIS Components

Server Software Component: Terminal Services DLL

Implant Internal Image

Pre-OS Boot

Pre-OS Boot: System Firmware

Pre-OS Boot: Component Firmware

kellis