Understanding End-User Attacks: Real-World Phishing & Post-Exploitation
TrustedSec founder Dave Kennedy analyzes the dominance of targeted phishing attacks, demonstrating macro weaponization, PowerShell evasion, and lateral movement.
Summary
The Shift to User-Centric Breach Vectors
As external network perimeters harden, targeted spear phishing against non-technical employees has emerged as the primary initial access vector for advanced threat actors.
Weaponizing Documents and Office Macros
Dave Kennedy demonstrates crafting obfuscated VBA macros and HTA payloads that bypass traditional email gateway virus scanners.
Living Off the Land and In-Memory Execution
Kennedy illustrates executing PowerShell scripts directly in RAM, bypassing AppLocker, and executing lateral movement without writing files to disk.
Architecting Multi-Layered Endpoint Defenses
The author details defensive strategies—including disabling legacy macro execution, enforcing PowerShell Constrained Language Mode, and deploying behavioral EDR.
Related talks
Main Stage·21 min
Rich Kelley
Rich Kelley introduces Harness, a remote PowerShell payload execution and management framework designed for stealthy interactive post-exploitation.
Village Presentations·40 min
Adam Compton · Eric Gershman
Adam Compton and Eric Gershman introduce the SpeedPhishing Framework (SPF), automating target email harvesting, domain staging, and campaign deployment.
Main Stage·16 min
Scott Taylor
Scott Taylor introduces C4, an open-source framework decoupling payload implants from command-and-control protocols using versatile external connectors.