Completed
Robby Winchester
Class Central Classrooms beta
YouTube videos curated by Class Central.
Classroom Contents
Process is No One Hunting for Token Manipulation
Automatically move to the next video in the Classroom when playback concludes
- 1 Intro
- 2 Game of Thrones
- 3 Jared Atkinson
- 4 Robby Winchester
- 5 Hypothesisdriven hunting
- 6 Pyramid of pain
- 7 Tactics Techniques Procedures
- 8 How does this apply
- 9 The hunt hypothesis process
- 10 Case Study Detecting Access Token Manipulation
- 11 First Step Tactics
- 12 Access Token Manipulation
- 13 Windows Authentication
- 14 logon session types
- 15 token types
- 16 token theft
- 17 how it works
- 18 create process with token
- 19 make impersonate token
- 20 set thread token
- 21 identify collection requirements
- 22 collect data points
- 23 collect access tokens
- 24 get access token
- 25 benign impersonation
- 26 impersonating system token
- 27 ticket granting token
- 28 identify scope
- 29 exclude factors
- 30 exclude techniques
- 31 demo
