Stories from the trenches - How a red team exercise gained full control of a client network
summary
A red team starts with forgotten and spoofed domains, registers lookalike names, and hosts a cloned site that serves a fake Windows update; voice-based social engineering convinces four users to run the payload, a DLL sideload persistence implants a callback, and a misconfigured VPN template exposing cleartext usernames lets the team authenticate as Domain Admin and perform asset discovery until they have full domain control with no EDR or SIEM alerts detected. The exploit chain works and the client later replaces the EDR.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 3:36Red team exercise overview
- 5:45Telis security services explained
- 8:13Penetration testing vs red teaming
- 10:21Social engineering techniques
- 12:45Wi-Fi access incident story
- 18:29Fake names episode
- 20:14Red team process phases
- 26:15Customer engagement setup
- 28:01Domain cloning and malware attack
- 33:41Gaining persistent network access
- 35:29Revealing the breach to the client
- 37:35Security gaps and misconfigurations
- 39:40Conclusion and cybersecurity advice
- 41:32Q&A session
related talks
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
12mIntroduction To Red Team Tooling And Opsec
30mTales of Red Teaming
52mStart covering your bases & Stop chasing APT headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
48mHow to Rob a Bank over the Phone - Lessons Learned from an Actual Social Engineering Engagement
46mNext Generation Red Teaming
42mRed vs. Bank: Surviving a Three Year Red Team