Atomic Red Team: Closing the Gap with Threat Actors

Explore a conference talk from Conf42 Incident Management 2023 that delves into Atomic Red Team and its role in bridging the gap with threat actors. Learn about the challenges in cybersecurity, the MITRE ATT&CK framework, and practical solutions for breach attack simulation on a budget. Discover how to implement specific atomic tests, including WinPwn PowerSharpPack Seatbelt and dumping Active Directory databases with ntdsutil. Gain insights from Chris Haller's expertise in the field and understand how these techniques can enhance your organization's security posture. The 25-minute presentation covers a comprehensive agenda, from introducing the problem to demonstrating practical applications and concluding with a Q&A session.

intro
preamble
agenda
who is chris
the problem
knowns matrix
a solution
mitre att&ck
procedures
atomic red team
breach attack simulation on a budget
atomic test #22 - winpwn - powersharppack - seatbelt
atomic test #3 - dump active directory database with ntdsutil
conclusion
questions?