Save $350 on Hands-on Cyber Security Training at SANS Sonoma 2019! Ends 11/21.

San Francisco Spring 2019

San Francisco, CA | Mon, Mar 11 - Sat, Mar 16, 2019
Event starts in 116 Days
 

No Seriously, I Can Still See You!

  • Jonathan Ham
  • Wednesday, March 13th, 7:15pm - 8:15pm

Everything leaves footprints on the network, whether it's a frontal assault on an Internet-facing SMB, or a lateral move living off the land with harvested creds. The Red Team only has the advantage up until the window breaks (I heard that!). Once you are in my house, I have the advantage (I know that squeaky floorboard!). Here's what it looks like when you think you can steal my stuff.

Obfuscate your Powershell 10x. Drop PEs via DDE and Word macros. DLL inject mimikatz. Evade AV. Fine. But to MitM you have to mess with L2/L3, and to move laterally you have to do things on L3/L4 that shouldn't be.

And when you do, I can still see you.


Bonus Sessions

The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:

  • SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
  • Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
Monday, March 11
Session Speaker Time Type
General Session - Welcome to SANS David Hoelzer Monday, March 11th, 8:00am - 8:30am Special Events
OODA Security: Taking Back the Advantage Kevin Fiscus Monday, March 11th, 7:15pm - 9:15pm Keynote
Tuesday, March 12
Session Speaker Time Type
Hunting Logic Attacks Hassan El Hadary Tuesday, March 12th, 7:15pm - 8:15pm SANS@Night
Wednesday, March 13
Session Speaker Time Type
No Seriously, I Can Still See You! Jonathan Ham Wednesday, March 13th, 7:15pm - 8:15pm SANS@Night