Talks

Hacks

Bug Bounty

Cyberrange

A red team mentor in the Standoff 16 Cyberbattle

Guiding light

Caused critical events in the HighTechEnergy infrastructure

High voltage

Caused critical events in the NetFusionPro infrastructure

Connection failure

Caused critical events in the Metal & Tech infrastructure

Shock worker

Caused critical events in the banking system

The Wolf of Wall Street

Standoff 15 attacker

Caused the following critical events:
Banking operation data leak
Withdrawal of funds from client accounts through RBS
Merchant portal hack and arbitrary QR code generation
Main database server hack Unauthorized access to payment server control
Withdrawal of funds from client accounts through a teller terminal
Compromise of access accounts used with First Partner Bank apps
Withdrawal of funds from bank accounts through ABS Sensitive bank information leak
Withdrawal of funds from bank accounts through ARM KBR Bank customer data leak

Bookkeeper of the year

Caused the following critical events:
Banking operation data leak
Merchant portal hack and arbitrary QR code generation
Merchant portal database leak
Main database server hack
Unauthorized access to payment server control Compromise of access accounts used with First Partner Bank apps

Fast payments superhero

Standoff Cyberrange (2024)

Created a vulnerable service for the cyberrange to drive the training process

Cyberarchitect

Standoff 13 attacker

Standoff 11 attacker

Initial Access

Valid Accounts

Default Accounts

Domain Accounts

Local Accounts

Cloud Accounts

Replication Through Removable Media

External Remote Services

Drive-by Compromise

Exploit Public-Facing Application

Supply Chain Compromise

Compromise Software Dependencies and Development Tools

Compromise Software Supply Chain

Compromise Hardware Supply Chain

Trusted Relationship

Hardware Additions

Phishing

Spearphishing Attachment

Spearphishing Link

Spearphishing via Service

Spearphishing Voice

Content Injection

Wi-Fi Networks

Execution

Windows Management Instrumentation

Scheduled Task/Job

Cron

Scheduled Task

Systemd Timers

Container Orchestration Job

Command and Scripting Interpreter

PowerShell

AppleScript

Windows Command Shell

Unix Shell

Visual Basic

Python

JavaScript

Network Device CLI

Cloud API

AutoHotKey & AutoIT

Hypervisor CLI

Software Deployment Tools

Native API

Shared Modules

Exploitation for Client Execution

User Execution

Malicious Link

Malicious File

Malicious Image

Malicious Copy and Paste

Inter-Process Communication

Component Object Model

Dynamic Data Exchange

XPC Services

System Services

Launchctl

Service Execution

Systemctl

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Input Injection

ESXi Administration Command

Persistence

Boot or Logon Initialization Scripts

Logon Script (Windows)

Login Hook

Network Logon Script

RC Scripts

Startup Items

Account Manipulation

Additional Cloud Credentials

Additional Email Delegate Permissions

Additional Cloud Roles

SSH Authorized Keys

Device Registration

Additional Container Cluster Roles

Additional Local or Domain Groups

Modify Registry

Create Account

Local Account

Domain Account

Cloud Account

Office Application Startup

Office Template Macros

Office Test

Outlook Forms

Outlook Home Page

Outlook Rules

Add-ins

Software Extensions

Browser Extensions

IDE Extensions

BITS Jobs

Traffic Signaling

Port Knocking

Socket Filters

Server Software Component

SQL Stored Procedures

Transport Agent

Web Shell

IIS Components

Terminal Services DLL

vSphere Installation Bundles

Implant Internal Image

Pre-OS Boot

System Firmware

Component Firmware

Bootkit

ROMMONkit

TFTP Boot

Create or Modify System Process

Launch Agent

Systemd Service

Windows Service

Launch Daemon

Container Service

Event Triggered Execution

Change Default File Association

Screensaver

Windows Management Instrumentation Event Subscription

Unix Shell Configuration Modification

Trap

LC_LOAD_DYLIB Addition

Netsh Helper DLL

Accessibility Features

AppCert DLLs

AppInit DLLs

Application Shimming

Image File Execution Options Injection

PowerShell Profile

Emond

Component Object Model Hijacking

Installer Packages

Udev Rules

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Authentication Package

Time Providers

Winlogon Helper DLL

Security Support Provider

Kernel Modules and Extensions

Re-opened Applications

LSASS Driver

Shortcut Modification

Port Monitors

Print Processors

XDG Autostart Entries

Active Setup

Login Items

Compromise Host Software Binary

Modify Authentication Process

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Reversible Encryption

Multi-Factor Authentication

Hybrid Identity

Network Provider DLL

Conditional Access Policies

Hijack Execution Flow

Dylib Hijacking

Executable Installer File Permissions Weakness

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

Path Interception by Unquoted Path

Services File Permissions Weakness

Services Registry Permissions Weakness

COR_PROFILER

KernelCallbackTable

AppDomainManager

Power Settings

Exclusive Control

GeenStack