Save $350 on Hands-on Cyber Security Training at SANS Sonoma 2019! Ends 11/21.

Sonoma 2019

Santa Rosa, CA | Mon, Jan 14 - Sat, Jan 19, 2019
Event starts in 60 Days


  • Jonathan Ham
  • Monday, January 14th, 7:15pm - 9:15pm

Everything leaves footprints on the network, whether it's a frontal assault on an Internet-facing SMB, or a lateral move living off the land with harvested creds. The Red Team only has the advantage up until the window breaks (I heard that!). Once you are in my house, I have the advantage (I know that squeaky floorboard!). Here's what it looks like when you think you can steal my stuff.

Obfuscate your Powershell 10x. Drop PEs via DDE and Word macros. DLL inject mimikatz. Evade AV. Fine. But to MitM you have to mess with L2/L3, and to move laterally you have to do things on L3/L4 that shouldn't be.

And, when you do, I can still see you.

Bonus Sessions

The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:

  • SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
  • Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
Monday, January 14
Session Speaker Time Type
General Session - Welcome to SANS Mick Douglas Monday, January 14th, 8:00am - 8:30am Special Events
492063616E207374696C6C2073656520796F7521 Jonathan Ham Monday, January 14th, 7:15pm - 9:15pm Keynote
Tuesday, January 15
Session Speaker Time Type
Stop Ransomware (and Other Attacks) in it's tracks with Pause-Process Mick Douglas Tuesday, January 15th, 7:15pm - 8:15pm SANS@Night