Tuesday

This recording is a multi-hour block of Breaking Ground talks rather than a single presentation. The opening session walks through compromising a hardened Active Directory estate by abusing CI/CD pipelines, runners and cloud identities, relying on built-in consoles and administrative functions instead of attack tools. It shows how a pipeline spanning data and control planes can become a route to domain-level impact.

Later sessions cover cloud shell services repurposed as hidden compute and storage, mapping network bridges and cross-protocol gateways in OT and out-of-band management devices, and analysing how pentesters actually chain commands across an engagement. Other talks look at bring-your-own-vulnerable-driver attacks against endpoint products, UEFI bootkit debugging and Secure Boot bypasses, a SIEM built on firewall log normalization, and an LLVM-based obfuscator for Rust binaries.

For practitioners, the common thread is that attackers exploit trusted features, identities and signed components rather than novel bugs. Useful takeaways include limiting the blast radius of credentials, treating CI/CD and cloud identity as control-plane assets, reducing standing privilege, disabling unused forwarding and out-of-band interfaces, and treating signed drivers and boot components as attack surface.