Offensive Operations
Explore content featuring this instructor’s insights and expertise.
AI can accelerate red team tool development, but only with the right approach. This hands-on workshop explores “vibe coding,” showing how to use LLMs to design, validate, and build evasion tooling step by step, resulting in a functional, AI-assisted red team framework.
In this presentation, Jean-Francois Maes will take you on a journey of how LLMs work, why you are likely using it wrong if you're using it like Google search and how to implement patterns to get better results both in daily conversation as well as vibe coding.
Threat intelligence is critical to effective adversary emulation. In this hands-on workshop, you'll learn how to analyze real-world threat reports, map adversary techniques to MITRE ATT&CK, and use AI-assisted workflows to accelerate TTP extraction and red team planning.
Command and Control doesn’t have to be command-heavy. This hands-on workshop shows how to use AI and the Model Context Protocol (MCP) to interact with Empire C2 through natural language, streamlining red team operations and reducing friction during engagements.
This hands-on, scenario-driven workshop delves into how attackers move stealthily through Active Directory environments using user impersonation and lateral movement techniques.
During offensive operations engagements, We often find ourselves repeating the same playbooks over and over again, getting success every time. Are we actually becoming better as an industry in improving security posture? Attend the talk to find out! Warning: Rants inside!
Multi-Factor Authentication (MFA) is often hailed as the gold standard for securing online accounts – but is it truly unbreakable?
In this workshop, SANS instructor and lead author of SEC565: Red Team Operations and Adversary Emulation, Jean-Francois Maes, will walk the audience through a guided hands-on workshop where common Active Directory Privilege Escalation Attacks are going to be discussed and executed using Empire version 5.
In this presentation certified instructor Jean-Francois Maes is going to speak about what cloud vendors don't want you to know: your attack surface when you use cloud resources. He will cover various services and, more importantly, the risk associated to using with using theses services in your organization.
In this preview of new material directly from the updated SANS SEC699: Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection, we will introduce various Living Off the Land Binaries and Scripts (LOLBAS), how to emulate them, detect, and respond to them in a true purple team fashion.
As a follow-up of our previous workshop, we will continue building our purple team stack by emulating a number of different techniques and looking at different options for detection. In this particular workshop we will focus on the following topics:Stealing Credentials from LSASSCOM Object HijackingOffice Persistence We will introduce the topics using a short lecture and afterwards get our hands dirty with lab exercises! Prerequisites: Familiarity with Linux and Windows is mandatory System Requirements: Prior to the workshop participants should prepare the following -Download and install the workshop VM: https://sansurl.com/purple-team-stack-workshop-vmInstalled 64-bit host operating systems (Windows is recommended)Download and install VM Workstation Pro 15.5 or higher, VMware Fusion 11.5 or higher, or VMware Workstation Player 15.5 or higher versions on your system prior to the start of the workshopAdobe Acrobat or other PDF readerImportant! An AWS account is required to do hands-on exercises during the workshop. The AWS account must be created prior to the workshop.A credit card should be linked to the AWS account that was created. Estimated usage costs for the AWS account during the workshop are a maximum of $10. For detailed instructions on these preparation steps, please refer to the following URL: https://sansurl.com/purple-team-stack-workshop-readme * Please note that this WILL NOT be recorded. Due to the nature of these workshops, many have a capacity limit and will not be made available for archive. To help us offer this opportunity to as many people as possible, we are asking that you please only register if you plan to attend live.