BEGIN:VCALENDAR
CALSCALE:GREGORIAN
PRODID:-//Apple Inc.//iOS 6.1.3//EN
VERSION:2.0
BEGIN:VTIMEZONE
TZID:Europe/Amsterdam
BEGIN:DAYLIGHT
DTSTART:19810329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:19961027T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DESCRIPTION:Detecting a breach is hard\, detecting someone who targets your network spe
 cifically is even harder. As pentesters\, we notice that we often remain un
 detected and breaching an infrastructure via an external server generally g
 oes unnoticed. However\, indications of our breach could definitely have be
 en picked up\, we could have been detected. So\, why weren’t we? This tal
 k focusses on using simple detection mechanisms that detect specific post e
 xploitation steps. We demonstrate simple tricks that can be used as a final
  warning mechanism. We choose to focus on the behaviour of an attacker and 
 give them what they want. Is the attacker using Mimikatz? Give them (fake) 
 credentials. Are they using Responder? Broadcast WPAD queries! Port scannin
 g the network? Give them something to port scan! Design small traps from an
  attackers perspective to detect someone snooping around.\n\nModern compani
 es have various detection systems and immense amounts of logging. Not every
  alarm can be followed up\, there needs to be a proper justification before
  starting a full-scale investigation. Indications of an initial breach (exp
 loit-kit/phishing/malspam) do not justify a full-scale investigation. Howev
 er\, indications of post exploitation directs you towards a more focussed i
 nvestigation. Assuming you don’t have many indications of post exploitati
 on \;).<b>
DTEND;TZID=Europe/Amsterdam:20170805T160000
DTSTAMP:20170804T093755Z
DTSTART;TZID=Europe/Amsterdam:20170805T153000
LAST-MODIFIED:20170804T093748Z
LOCATION:Re
SEQUENCE:0
SUMMARY:Detecting a breach from an attackers perspective. - Rik van Duijn\, Wesley 
 Neelen
TRANSP:OPAQUE
UID:ce7ba341-f44e-4f82-9f67-45e2df6b9c67@frab.sha2017.org
URL;VALUE=URI:https://program.sha2017.org/events/47.html
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:Reminder
TRIGGER:-PT1H
UID:56856F1F-5B17-4046-B95D-3EE95F75E06E
X-APPLE-DEFAULT-ALARM:TRUE
X-WR-ALARMUID:56856F1F-5B17-4046-B95D-3EE95F75E06E
END:VALARM
END:VEVENT
END:VCALENDAR
