Simulation Hacking, the Good, Bad and the Ugly
summary
Demonstrates that OS isolation and TPM-backed Credential Guard change whether credential-dumping attacks succeed, using the DG Readiness toolkit to enable protection and Atomic Red Team (T1003) to run a credential-harvest test that writes an expected NppSpy.txt artifact. Microsoft Defender for Endpoint (MDE) catches and quarantines the Atomic Red Team payload so the dump never appears, proving detection at scale; also compares techniques (PowerShell-based atomic tests vs .NET loaders like PurpleSharp), warns mimikatz is widely detected and fragile.
AI-written summary · about
chapters (7)
- 0:00Introduction to simulation hacking
- 7:47Windows isolation and sandboxing
- 16:35Demo credential guard setup
- 22:49Atomic Red Team tool overview
- 37:16Red teaming with MITRE ATT&CK
- 39:46Choosing simulation software wisely
- 40:27Q&A and closing remarks
related talks
36mBeing A Better Defender By Channeling Your Worst Adversary:
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
12mIntroduction To Red Team Tooling And Opsec
54mWant to Play a Game? Get Your Game On with Hacking Gamification
49mBreaking Hardware-Enforced Security With Hypervisors
52mStart covering your bases & Stop chasing APT headlines
48mLateral Movement in the Age of Hybrid Cloud