Hacking Exposed: Next-Generation Tactics, Techniques, and Procedures
summary
Demonstrates a live case where attackers use Tails on a USB, DigitalOcean droplets and VPNs, then run evilginx session cookie replay to steal Office 365 session tokens and bypass MFA, register burner-phone authenticators, install AnyDesk for persistence, and create SpiderUser1/2 via the AD PowerShell module by abusing delegated AD permissions (no domain admin). CrowdStrike telemetry shows 71% of incidents use no malware and average lateral break‑out drops to ~84 minutes; the demo fully succeeds: credentials, persistence, SQL data export and USB exfiltration.
AI-written summary · about
chapters (11)
- 0:00Welcome and introduction
- 1:33Focus on eCrime threats
- 6:34Case study overview
- 12:18Demo setup and tools
- 14:26Vishing and phishing attack
- 17:39MFA bypass with evilginx
- 20:11Establishing persistence
- 27:20Adding users via AD delegation
- 33:53Data exfiltration process
- 39:20Countermeasures and detection
- 46:52Wrap-up and key takeaways
related talks
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
58mHacking in 2016 - How is our systems broken?
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
42mStart Covering Your Bases And Stop Chasing APT Headlines
52mStart covering your bases & Stop chasing APT headlines
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field