Remote Work Attacks and Scenarios in Hybrid Environment

~ November 24, 2020 ~

This module involves various attacks on identity, mitigations, and risk assessment factors. You will learn the techniques used by modern malware. Especially for ransomware, the launch process itself has changed over the years to reach its final form – it is important to know how to prevent it. You will become familiar with important aspects of cloud security including easy to use solutions, integration with the current environment, and monitoring tools.

Secrets and Techniques of Code Execution: A Detailed Analysis on Fileless Malware

~ November 26, 2020 ~

After successful delivery, malicious code exploits a vulnerability or misconfiguration to execute code on the victim’s system. Fileless malwareuses system tools and in-memory execution techniques to do its damage. There are many mechanisms that, if properly configured, significantly reduce attack scope. So, every red teamer and blue teamer should know the modern hacking techniques that are commonly used to get any personal or company information. During this Module, CQURE Experts will show you the malware in detail and its deepest secrecy. We will discuss Office suite macros (both VBA and XLM), malicious PDFs, Living Off The Land Binaries and Scripts, and many more techniques to know more about fileless malware.

• Macros
• XLM
• XSLT+wmic
• Lolbinsy
• JScript etc.
  

Certificates and Public Key Infrastructure

~ December 1, 2020 ~

Would you like to know more about troubleshooting the health of the PKI infrastructure and how to validate if it is in a healthy state? CQURE Experts show you how to create proper modern certification templates that can serve typical web servers or other application. We will go through the implementation of the code signing technique, using a modern approach to code signing from 3rd party application.

Deep Dive into Cloud Penetration Testing

~ December 3, 2020 ~

In this Module our Experts will take a deep dive into penetration testing on Azure and other cloud technologies, for instance AWS. We will show you how to perform penetration tests in the Cloud environment in 2021 and we will explain how typical misconfigurations may allow the attacker to gain access to your cloud resources. During our session the following topics will be taken into consideration:

• Formal preparation to perform penetration test
• Analyzing access methods, storage, network security
• Reconnaissance
• Attacking virtual machines.​​

Deploying a Secure and Easy to Manage Allow-Listing (formerly Whitelisting) Solution

~ December 8, 2020 ~

In 2020+ the most important security measure in enterprises is whitelisting” says Gartner and multiple other agencies. In Windows this means you need to implement AppLocker. Join this workshop where one of the leading experts in Windows OS and Security, Sami Laiho, shows you how to effectively and securely deploy AppLocker in your environment. Sami has deployed AppLocker for tens of companies ranging from one-man to 500000 seat companies. If you think deploying AppLocker will need new hires you got it wrong – it will make you work less!

• Allow/Deny-listing(White/Blacklisting)
• Mistakes
• Bypassing
• Best practices
  

Privilege Escalation Bugs and Techniques in Windows

~ December 10, 2020 ~

During this Module, our Experts will discuss Windows privilege escalation techniques. Although times, when everyone was using admin privileges (to do basically anything), are long gone, hackers still know how to elevate privileges and get local admin. The trick is to carefully inspect system and target elevated processes, services, and users. In this module, we will focus on ACLs, tokens and privileges to understand how various system checks are bypassed. We will cover UAC bypasses, Time-of-check-time-of-use bugs, insecure permissions, logic flaws, and many more!

• ACLs
• Tokens
• UAC
• Procmon, symlinks, oplocks
  

Monitoring Cloud Security

~ December 15, 2020 ~

Monitoring is a critical component of cloud security and management. Unfortunately, its complexity causes the “reactive mode”. This time our Experts show you how to avoid the inexcusable mistakes in 2021. Join us during this module to understand what should be avoided and how to operate in a secure way to ensure that critical assets are protected.

Designing Effective Security Awareness Campaign (Not only during the Holiday Season)

~ December 17, 2020 ~

It sounds like a Holiday Module, but it is not! This module will be a very technical trip, as we will learn how to build custom phishing campaigns with the available toolkit while using a custom approach. During the session, you will see our scenarios from real-life cases and, then, you will understand (Holiday) phishing in detail.

Pentesting Azure Active Directory

~ January 12, 2021 ~

Our Expert, Michael Grafnetter, will guide you through all stages of a pentest targeting Azure AD, from the recon phase, through credential-based attacks like password spraying, pass-the-PRT, MFA bypass, and app credentials to post-exploitation techniques. Attacks against a hybrid environment and cross-premises takeovers will also be covered.

FIDO2 Authentication Deep-Dive

~ January 14, 2021 ~

FIDO2 CTAP and W3C Web Authentication enable users to leverage common devices to easily authenticate to online services in both mobile and desktop environments. These standards include support for security keys (e.g. YubiKey, Feitian, or Crayonic) and for platform authenticators (e.g. Windows Hello, Apple Face ID, or Touch ID). After this Module, attendees become familiar with the technical details of FIDO2 authentication and aware of its limitations and possible attack vectors.

Advanced IIS Monitoring and Attack Mitigation

~ January 19, 2021 ~

We will start by looking through the eyes of an attacker and how his/hers actions manifest in IIS. The session will explore monitoring tips and tricks, which will be useful in detecting anomalies and reacting appropriately. Finally, we’ll have a look at some hardening elements that could completely prevent the attack or at least slow it down.

Windows Server Web Application Proxy vs. Azure AD Application Proxyy

~ January 21, 2021 ~

In this session, we will focus on two methods of secure web application publishing to the internet. Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Windows Server also contains a built-in Web Application Proxy. We will be discussing security aspects of these solutions, like adding multi-factor authentication to applications that do not support it out-of-the-box, translating claims-based authentication to Kerberos, publishing apps without having a public IP address, or protective measures against DDoS attacks.