Breaking the Attack Chain by Corey Ham & Matt Eidelberg

Red team operators Corey Ham and Matt Eidelberg dissect a complex enterprise red team engagement, walking through the complete attack lifecycle to identify critical chokepoints where blue teams can successfully disrupt adversary progression [00:00]. The speakers examine the attack chain from initial access through full domain compromise, demonstrating how minor operational security oversights allow attackers to compound initial footholds into complete network takeover [35:25].

The case study details the offensive progression, starting with targeted external spearphishing to gain initial userland code execution and establishing covert command-and-control channels [35:25]. The speakers illustrate lateral movement techniques, credential harvesting via LSASS memory dumping, and token manipulation across internal subnets [35:25]. In a key operational highlight, they reveal how they maintained resilient out-of-band persistence under tight deadlines by compromising corporate conference room audio/visual telepresence systems when internal workstations were locked down [46:57].

Ham and Eidelberg map each offensive action to corresponding defensive mitigations, explaining how organizations can "break the chain" [58:13]. They emphasize high-impact defensive architectural controls, including workstation-to-workstation traffic blocking, Local Administrator Password Solution (LAPS) deployment, restricted Kerberos delegation, and proactive egress filtering.

(AI summary — Gemini Flash)