Baselining Behavior Tradecraft through Simulations

Explore a conference talk from GrrCON 2019 focused on baselining behavior tradecraft through simulations. Dive into the importance of understanding industry trends, living off the land techniques, and Windows-based attack methods. Learn about new techniques, including Windows Defender bypass and commodity attacks. Discover how to build and tell a compelling story through attack paths and technical articles. Examine the challenges of social engineering and defeating software, while emphasizing the significance of balanced scorecards and code execution prevention. Gain insights into the evolving landscape of cybersecurity and the importance of community engagement in the field.

Intro
Why are we here today
Goals for today
Industry today
Living off the land
Windows Update
Scriptlet Object
Scripted Logic
PowerShell
New Techniques
Download executables
Windows Defender Bypass
Commodity Attacks
Registry R32
Attack Path
Tech Article
Build a Story
Use Noise
Tell the Story
In Every Phase
Weve Got Lazy
Social Engineering
Defeating Software
Its Not Easy
Balanced Scorecard
Focus on Code Execution
Work Prevention
Closing
DerbyCon Communities