A technical presentation on high interaction honeypots in an Red/Blue training environment. The presentation will describe ICS honeypots, the benefits and real life practical use, both in real industrial environments and in learning networks;

Finding malware callback beacons to C2 servers in modern network traffic has many challenges. Most traffic is encrypted and traditional IoC signatures can only find known threats. This talk presents how simple data mining and statistics can be applied on Suricata TLS and Flow events to reveal infrequent TLS servers, connections with periodic patterns, and how TLS JA3S enables it all;

A walk through of how to monitor OT networks with the open source software ntopng, covering OT protocol nuances and what to look for in your network in a hands-on manner;

How often do you define permissions for new cloud-native applications and do you use the pre-defined vendor suggestion for them or use wildcards? IAM (Identity and Access Management) is an important factor in determining how secured your product will be. Doing it right requires an understanding of how it works and why it is important, which is the purpose of this session. We will talk about what is IAM, how do you use it, what are the risks of an overly permissive configuration - and show a demo of ways to exploit it and how you can minimize the exposure;

Cybercriminals are dynamic by nature and they are always trying to find easy money. Once a threat actor finds an easy way to make money, this spreads from forum to forum, from chat to chat, gaining more and more “followers” of the technique. This happened with the targeted ransomware attacks and they are here to stay. In this talk we will show examples about how tracking the Deep Web can gather valuable insights about those ransomware groups and their activities, in order to be up-to-date with their latest movements. Knowing the enemies is key to defend against this threat. The talk will start with a short intro in the dark web analytics services, OSINT and use of such services in daily security risk management.

Active Directory environments rely on Kerberos as their main authentication protocol as a superior alternative to NTLM and plain text LDAP. But guess what? There is nothing that partial implementation cannot screw up and Kerberos is no exception – and we’ve spotted such implementation at four leading security products exposing them to easy takeover (Cisco, IBM, F5 and Palo Alto Networks – but no worries all disclosed, reported and fixed). When correctly implemented, Kerberos involves three exchanges: an Authentication Service exchange, followed by a Ticket Granting Service exchange, and concluded with a Client/Server exchange. However, the four products we’ve analyzed featured a partial implementation in which the Client/Server exchange (number three) was not present at all. While it seems as if the authentication works properly even without this exchange, its absence creates a huge gap that can be easily exploited in a spoofing attack. In this session we’ll deep dive into the details of this spoofing attack and demonstrate how it can use to either bypass security controls or gain full admin privileges in Cisco ASA, IBM QRadar, F5 Big-IP APM, and Palo Alto Networks PAN-OS.

Evolving endpoint protection software with enhanced detection capabilities and greater visibility coverage have been taking red team and purple team operation’s complexity to a higher level. The current situation forces adversaries to take precautions and invest much more time in the weaponization phase to overcome prevention and detection mechanisms. Our framework leverages Infrastructure as Code (IaC) to fully automate the deployment of our offensive CI/CD pipeline framework with built in recipes for evading host and network detections. The framework leverages Gitlab CI/CD in conjunction with Kubernetes cluster to automate and manage the process of building and deploying offensive tools at scale.

The in-depth tech demo will focus on a swiss-army knife for fabricating and generating events in the form of logs, metrics, traces, and transactions to stress test the performance and correctness of your XDR/SIEM solution @ scale.