Detection: Challenging Paradigms

Justin Kohler joins Jared in this special episode to talk about the Hybrid Attack Paths feature update to Bloodhound Enterprise and Bloodhound CE. This is a valuable tool for defenders to understand the hygiene of their identity and access management deployment in a Windows-based enterprise. Links: https://github.com/SpecterOps/BloodHound

The Summiting the Pyramid project by MITRE's Center for Threat Informed Defense (CTID) released in September 2023, allowing for a unified method of "grading" detections for efficacy. Two of the pivotal members of that project join Jared and Luke to talk about how it came to be, and how it can be used to further the detection program of any organization! Project Links: Initial Release Blog Post Summiting the Pyramid Documentation Get Involved

Chris Thompson (@_Mayyhem on X) joins Jared and Luke on this episode of DCP! Chris has led the charge on offensive research into System Center Configuration Manager (SCCM), and shares his insight into this often overlooked aspect of the threat landscape! Resources: #sccm on the BloodHoundGang slack workspace: https://bloodhoundgang.herokuapp.com/ https://medium.com/@Mayyhem

DCP is back! New intro, new cover, new host! With Jonny stepping away from the podcast, Luke has moved into the co-host position with Jared. On this first episode, we are joined by Luke Jennings of Push Security to talk all things SaaS. Links: https://github.com/pushsecurity/saas-attackshttps://pushsecurity.com/blog/saas-attack-techniques/https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/https://pushsecurity.com/blog/nearly-invisible-attack-chain/https://pushsecurity.com/blog/slack-phishing-for-initial-access/https://pushsecurity.com/blog/phishing-slack-persistence/

In this captivating episode, we delve into the world of Azure security with Ryan Hausknecht, Senior Security Researcher at Microsoft. Learn about his groundbreaking projects, the Azure Threat Research Matrix and the AzDetectSuite, and how they assist researchers and defenders in protecting against various attack techniques. We also discuss the complexities of Azure permissions and access control, and explore the nuances of the REST API, PowerShell, Azure CLI, and the Azure Portal. Don't miss this opportunity to learn from an expert and take your Azure security skills to new heights!

Discover the power of canaries in cybersecurity and learn how to implement them the right way with our special guest, Casey Smith from Thinkst Canary. Casey shares his extensive background in pentesting and defending, as well as the inspiration behind his current projects. This episode is jam-packed with insights on using various security methods, understanding the limitations of InfoSec tools, and exploring telemetry.

Discover the power of canaries in cybersecurity and learn how to implement them the right way with our special guest, Casey Smith from Thinkst Canary. Casey shares his extensive background in pentesting and defending, as well as the inspiration behind his current projects. This episode is jam-packed with insights on using various security methods, understanding the limitations of InfoSec tools, and exploring telemetry.

Maxime Lamothe-Brassard, co-founder of Lima Charlie stops in to talk with Jared and Jonny, and explain how Lima Charlie identified a problem in the industry and seeks to solve it. This is the second half of a full 1h 30m interview.

Maxime Lamothe-Brassard, co-founder of Lima Charlie stops in to talk with Jared and Jonny, and explain how Lima Charlie identified a problem in the industry and seeks to solve it. This is the first half of a full 1h 30m interview.

Two years and 28 episodes later, our first guest: Olaf Hartong of FalconForce rejoins Jared and Jonny in the studio. Olaf, as well as Jared, Jonny, and Luke will all be Blackhat instructors this year - and our collective opinions on Threat Hunting and Detection Engineering have evolved enough over the years to warrant further discussion. We hope you join us!