Backdoors & Breaches card list

Core Deck 53 cards

The original Core deck, and Engine-V2’s default.

Initial Compromise (10)

• Phish
• Web Server Compromise
• External Cloud Access
• Insider Threat
• Password Spray
• Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploitable External Service
• Credential Stuffing

Pivot & Escalate (7)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Stuffing
• New Service Creation
• Local Privilege Escalation

C2 / Exfiltration (6)

• HTTP as Exfil
• HTTPS as Exfil
• DNS as C2
• Windows Background Intelligent Transfer Service (BITS)
• Gmail, Tumblr, Salesforce, Twitter as C2
• Domain Fronting as C2

Persistence (9)

• Malicious Service/Just Malware
• DLL Attacks
• Malicious Driver
• New User Added
• Application Shimming
• Malicious Browser Plugins
• Logon Scripts
• Evil Firmware
• Accessibility Features

Procedure (11)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Review
• NetFlow,Zeek/Bro,Real Intelligence Threat Analytics (RITA) Analysis
• Internal Segmentation
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis

Inject (10)

• Honeypots Deployed
• It was a Pentest
• Data Uploaded to Pastebin
• SIEM Analyst Returns from Splunk Training
• Take One Procedure Card Away
• Give the Defenders a Random Procedure Card
• Lead Handler Has a Baby, Takes FMLA Leave
• Bobby the Intern Kills the System You are Reviewing
• Legal Takes Your Only Skills Handler Into a Meeting to Explain the Incident
• Management Has Just Approved the Release of a New Procedure

Core 3.1 57 cards

Official Core Deck v3.1 – downloaded from backdoorsandbreaches.com.

Initial Compromise (10)

• Credential Stuffing
• Exploited External Service
• Bring Your Own (Exploited) Device
• Social Engineering
• Compromised Trusted Relationship
• External Password Spray
• Insider Threat
• Unauthorized Cloud Access
• Compromised Web Server
• Phishing

Pivot & Escalate (7)

• Local Privilege Escalation (LPE)
• New Service Creation or Modification
• Credential Harvesting
• Weaponizing Active Directory
• Broadcast or Multicast Protocol Poisoning
• Kerberoasting
• Internal Password Spray

C2 / Exfiltration (6)

• Domain Fronting as C2
• Cloud-Based Services as Exfil
• Background Intelligent Transfer Service (BITS) as Exfil
• Domain Name System (DNS) as C2
• HTTPS as Exfil
• HTTP as Exfil

Persistence (9)

• Accessibility Features
• Malicious Firmware
• Logon Scripts
• Malicious Browser Plugins
• Application Shimming
• New User Added
• Malicious Driver
• Dynamic Link Library (DLL) Hijacking
• Malicious Service

Procedure (15)

• Permissions Audit
• Cloud Event Log Analysis
• Memory Analysis
• Crisis Management
• Isolation
• Endpoint Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Security Protection Analysis
• Active Defense and Cyber Deception
• Network Threat Hunting
• Firewall Log Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Server Analysis
• Firewall Log Review
• Memory Analysis

Inject (10)

• Honeypots Deployed
• It was a Pentest
• Data Uploaded to Pastebin
• SIEM Analyst Returns from Splunk Training
• Take One Procedure Card Away
• Give the Defenders a Random Procedure Card
• Lead Handler Has a Baby, Takes FMLA Leave
• Bobby the Intern Kills the System You are Reviewing
• Legal Takes Your Only Skills Handler Into a Meeting to Explain the Incident
• Management Has Just Approved the Release of a New Procedure

Green Expansion v2 16 cards

Expansion set – toggle it on in the Engine-V2 Scenario Editor to merge into any loaded deck.

Initial Compromise (3)

• Exploitation of Missing HTTP Strict Transport Security (HSTS)
• Supply Chain Attack
• Physical Access

Pivot & Escalate (5)

• Server Message Block (SMB) Abuse
• Internal Spearphishing
• Access Token Manipulation
• Stale Network Address Configurations (SNAC) Attack
• Cleartext Passwords in Files

C2 / Exfiltration (1)

• Physical Medium as Exfil

Persistence (4)

• Third-Party Malware Injection
• Malicious Email Rules
• Service Recovery Hijacking
• Startup Registry Injection

Procedure (3)

• Call a Consultant
• Physical Security Review
• Site Walkthrough

Expansion 1 35 cards

Expansion pack – toggle it on in the Engine-V2 Scenario Editor to merge into any loaded deck.

Initial Compromise (3)

• Missing HTTP Strict Transport Security (HSTS) Protection
• Supply Chain Attack
• Physical Access

Pivot & Escalate (5)

• SMB Weakness
• Internal Spearphishing
• Access Token Manipulation
• Stale Network Address Configurations (SNAC) Attack
• Cleartext Passwords in Files

Persistence (5)

• Event Triggered Malware
• Malware Injection into Client Software
• Malicious Email Rules
• Windows Service Recovery Actions
• Registry Keys for Persistence

Procedure (1)

• Call a Consultant

Inject (10)

• Food Poisoning
• SIEM Goes Down
• This Isn't the First Time, and Won't Be the Last
• EDR Compromise
• Attackers Taunt You
• Attackers Timestomp Key Evidence Files
• No Good Deed Goes Unpunished...
• Our Friend “Hacky”
• Is It Getting Hot in Here?
• "Don't Forget to Smash the Subscribe Button!"

Consultant (9)

• Alethe Denis
• Tim Medin
• Jorge Orchilles
• Alissa Torres
• Dieter Smith
• Marcus J. Carey
• Robert M. Lee
• Chloé Messdaghi
• Eric Conrad

Exfiltration (2)

• Traffic Signaling
• Exfiltration Over Physical Medium

ICS-OT 52 cards

ICS/OT focused deck.

Initial Compromise (8)

• Vendor Portal
• Dual-Homed Device
• Infected Authorized Vendor Laptop
• Data Historian Compromise
• IT Compromised With Shared Domain Trust
• Dirty USB
• Exploitable API
• Insider Threat

Pivot & Escalate (8)

• Malicious Project Files
• EWS Issues Rogue Commands
• Modifying Read/Write Scripts
• Internal Password Spray
• Broadcast/Multicast Protocol Poisoning
• New Service Creation/Modification
• Local Privilege Escalation
• GPO Push of Scheduled Tasks

C2 / Exfiltration (6)

• Screenshot Exfil
• Bridged System
• Exfiltration Over Physical Medium
• HTTP as Exfil
• TCP Handshakes as Morse Code
• DNS as C2

Persistence (9)

• Stolen Engineering Workstation (EWS) Account
• Malicious Logon Scripts
• GPO Modification
• Malicious Report Macros
• HMI Graphics Manipulation
• Malicious Firmware
• Autorun Malware
• New User Added
• Accessibility Features

Procedure (12)

• Sequence of Events (SOE) Analysis
• Protocol Analysis
• Crisis Management
• Site Walkthrough
• Shodan Review
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Review
• Consequence-Driven Threat Hunting
• Employee Interviews
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Memory Analysis

Inject (9)

• Unexpected PLC State Change
• Safety Instrumented System (SIS) Tampering
• Mediation
• You Can't Get There From Here
• Emergency Facility Shutdown
• Legacy Knowledge
• No High Availability (HA) System
• No Shirt, No Shoes
• USB Worm

Core v1 52 cards

Original v1 Core deck (dev-site archive).

Initial Compromise (10)

• Phish
• Web Server Compromise
• External Cloud Access
• Insider Threat
• Password Spray
• Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploitable External Service
• Credential Stuffing

Pivot & Escalate (7)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Stuffing
• New Service Creation
• Local Privilege Escalation

C2 / Exfiltration (6)

• HTTP as Exfil
• HTTPS as Exfil
• DNS as C2
• Windows Background Intelligent Transfer Service (BITS)
• Gmail, Tumblr, Salesforce, Twitter as C2
• Domain Fronting as C2

Persistence (9)

• Malicious Service/Just Malware
• DLL Attacks
• Malicious Driver
• New User Added
• Application Shimming
• Malicious Browser Plugins
• Logon Scripts
• Evil Firmware
• Accessibility Features

Procedure (10)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Review
• NetFlow,Zeek/Bro,Real Intelligence Threat Analytics (RITA) Analysis
• Internal Segmentation
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management

Inject (10)

• Honeypots Deployed
• It was a Pentest
• Data Uploaded to Pastebin
• SIEM Analyst Returns from Splunk Training
• Take One Procedure Card Away
• Give the Defenders a Random Procedure Card
• Lead Handler Has a Baby, Takes FMLA Leave
• Bobby the Intern Kills the System You are Reviewing
• Legal Takes Your Only Skills Handler Into a Meeting to Explain the Incident
• Management Has Just Approved the Release of a New Procedure

Core v3 52 cards

Core v3 deck (dev-site archive).

Initial Compromise (10)

• Phishing
• Web Server Compromise
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• External Service Exploitation
• Credential Stuffing

Pivot & Escalate (7)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Privilege Escalation (LPE)

C2 / Exfiltration (6)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domain Fronting as C2

Persistence (9)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shimming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features

Procedure (13)

• Server Analysis
• Security Infomation and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analysis (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Anaylsis
• Permissions Audit

Inject (7)

• False Alarm: It was a Penetration Test
• Data Uplaoded to Pastebin
• Analyst Returns from Incident Response Training
• 'Policy? What Policy?'
• Luck of the SOC
• Bobby the Intern Kills The System you are Reviewing
• Legal Takes Your Most Skilled Handler Into a Meeting to Explain the Incident

Core v2.2 52 cards

Core v2.2 deck (dev-site archive).

Initial Compromise (10)

• Phish
• Web Server Compromise
• External Cloud Access
• Inside Threat
• Password Spray
• Social Engineering
• Trusted Relationship
• Bring Your Own (Exploited) Device
• Exploitable External Service
• Credential Stuffing

Pivot & Escalate (7)

• Internal Password Spray
• Kerberoasting/ASREPRoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Stuffing
• New Service Creation/Modification
• Local Privilege Escalation

C2 / Exfiltration (6)

• HTTP as Exfil
• HTTPS as Exfil
• DNS as C2
• Windows Backgound Intelligent Transfer Service (BITS)
• Gmail, Tumblr, Salesforce, Twitter as C2
• Domain Fronting as C2

Persistence (9)

• Malicious Service
• DLL Attacks
• Malicious Driver
• New User Added
• Applicaiton Shimming
• Malicious Browser Plugins
• Logon Scripts
• Evil Firmware
• Accessibility Features

Procedure (11)

• Security Information and Event Management (SIEM) Log Analysis
• Server Analysis
• Firewall Log Analysis
• Network Threat Hunting - Zeek/RITA Analysis
• Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis

Inject (9)

• Honeypots Deployed
• It Was a Pentest
• Data Uploaded to Pastebin
• SIEM Analyst Returns From Splunk Training
• Take One Procedure Card Away
• Give The Defenders a Random Procedure Card
• Lead Handler Has a Baby, Takes FMLA Leave
• Bobby the Intern Kills the System You are Reviewing
• Legal Takes Your Most Skilled Handler Into a Meeting to Explain the Incident

CoreV3 Plus Expansion 92 cards

Core v3 with its expansion cards merged in (dev-site archive).

Initial Compromise (13)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Missing HTTP Strict Transport Security (HSTS) Protection
• Supply Chain Attack
• Physical Access

Pivot & Escalate (12)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• SMB Weakness
• Internal Spearphishing
• Access Token Manipulation
• Stale Network Address Configurations (SNAC) Attack
• Cleartext Passwords in Files

C2 / Exfiltration (7)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Exfiltration Over Physical Medium

Persistence (14)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Event Triggered Malware
• Malware Injection Into Client Software
• Malicious Email Rules
• Windows Service Recovery Actions
• Registry Keys for Persistence

Procedure (15)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Call a Consultant
• Physical Security Review

Inject (17)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Food Poisoning
• SIEM Goes Down
• This Isn't the First Time, and Won't Be the Last
• EDR Compromise
• Attackers Taunt You
• Attackers Timestomp Key Evidence Files
• No Good Deed Goes Unpunished...
• Our Friend, Hacky
• Is it Getting Hot in Here?
• Don't Forget to Smash the Subscribe Button!

Consultant (14)

• Alethe Denis
• Time Medin
• Jorge Orchilles
• Alissa Torres
• Dieter Smith
• Marcus J. Carey
• Robert M. Lee
• Chloe Messdaghi
• Eric Conrad
• John Strand
• Joff Thyer
• Beau Bullock
• Richard Phung
• Edward Miro

Core Spanish 1.0 52 cards

Spanish-language Core deck.

Initial Compromise (10)

• Phishing
• SERVIDOR WEB COMPROMETIDO
• ACCESO EXTERNO A LA NUBE
• AMENAZA INTERNA
• Password Spray
• RELACIÓN DE CONFIANZA
• INGENIERÍA SOCIAL
• TRAE TU PROPIO DISPOSITIVO (BYOD) (COMPROMETIDO)
• SERVICIO EXTERNO EXPLOTABLE
• USO DE CREDENCIALES ROBADAS

Pivot & Escalate (7)

• PASSWORD SPRAY INTERNO
• KERBEROASTING/ASREPROASTING
• ENVENENAMIENTO DE PROTOCOLOS BROADCAST/MULTICAST
• UTILIZANDO ACTIVE DIRECTORY COMO UN ARMA
• USO DE CREDENCIALES ROBADAS
• CREACION/MODIFICACIÓN DE NUEVO SERVICIO
• ESCALAMIENTO DE PRIVILEGIOS LOCALES

C2 / Exfiltration (6)

• HTTP COMO CANAL DE EXFILTRACIÓN
• HTTPS COMO CANAL DE EXFILTRACIÓN
• DNS Como C2
• SERVICIO DE TRANSFERENCIA INTELIGENTE EN SEGUNDO PLANO DE WINDOWS (BITS)
• GMAIL, TUMBLR, SALESFORCE, TWITTER COMO C2
• ENCUBRIMIENTO DE DOMINIOS COMO C2

Persistence (9)

• SERVICIO MALICIOSO
• ATAQUES CON DLL
• ADICIÓN DE NUEVO USUARIO
• CONTROLADOR MALICIOSO
• SHIMMING DE APLICACIONES
• PLUGINS DE NAVEGADOR MALICIOSOS
• SCRIPTS DE INICIO DE SESIÓN
• FIRMWARE MALICIOSO
• CARACTERÍSTICAS DE ACCESIBILIDAD

Procedure (11)

• ANÁLISIS DEL SERVIDOR
• ANÁLISIS DE BITACORAS DE SIEM
• REVISIÓN DE BITÁCORAS DE FIREWALL
• CACERÍA DE AMENAZAS DE RED CON HERRAMIENTAS ZEEK Y RITA
• CIBERENGAñO
• ANÁLISIS DE SEGURIDAD DE PROTECCIÓN DE ENDPOINTS
• ANÁLISIS DE COMPORTAMIENTO DE USUARIOS Y ENTIDADES (UEBA)
• ANÁLISIS DE ENDPOINTS
• AISLAMIENTO
• GESTIÓN DE CRISIS
• ANÁLISIS DE MEMORIA

Inject (9)

• HONEYPOTS DESPLEGADOS
• FUE UN PENTEST
• DATOS SUBIDOS A PASTEBIN
• ANALISTA DE SIEM VUELVE DEL ENTRENAMIENTO EN SPLUNK
• QUITAR UNA CARTA DE PROCEDIMIENTOS
• PROVEE A LOS DEFENSORES CON UNA CARTA DE PROCEDIMIENTO AL AZAR
• EL/LA COORDINADOR(A) DE INCIDENTES SE TOMA VACACIONES DE PATERNIDAD/MATERNIDAD
• EL PASANTE ROBERTITO INHABILITA EL SISTEMA QUE SE ENCUENTRA BAJO REVISIÓN.
• EL DEPARTAMENTO LEGAL SE LLEVA A TU MEJOR COORDINADOR DE INCIDENTES A UNA REUNION PARA EXPLICAR EL INCIDENTE QUE SE ESTÁ INVESTIGANDO.

Cloud Security 86 cards

Cloud-focused sponsor expansion.

Initial Compromise (17)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Cloud Service Password Spray
• Cloud Service Provider Vulnerability
• Credentials Posted Publicly in a Code Repository
• Malicious OAuth Applciation
• Misconfigured MFA
• Public Storage Bucket Exposed
• Out-of-Band Phish

Pivot & Escalate (15)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Query of Cloud APIs
• Credentials Exposed in Environment Variables
• Credential Store Compromise
• Instance Metadata Service Access
• Malicious File Upload to Shared File Service
• Identity and Acess Management (IAM) Policy Abuse
• Misconfigured Container Image Compromise
• Search and Pillage Emails

C2 / Exfiltration (9)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Create Inbox Rules to Forward Emails
• Malicious Serverless Function
• Virtual Machine Access via Web Portal

Persistence (13)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Backdoored Container Image
• Cross-Tenant Access
• MFA Bypass: App Password Creation
• Secondary Access Key Creation

Procedure (15)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Cloud Event Log Analysis
• Permissions Audit

Inject (17)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• AI Hacked Into Your Cloud Accounts
• Cloud Provider Disabled Vulnerable Functionality
• Cloud Bill Due
• Cloud Security Training
• Cryptominer
• Dangling Domains
• Exposed Cloud Access Keys During Public Presentation
• I'm Not the Cloud Person
• Regional Cloud Provider Data Center Outage
• Third-Party Code Library Compromised

DataDog 86 cards

DataDog sponsor expansion.

Initial Compromise (18)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Compromised Single Sign-On (SSO) Federated Identity
• Poisoned Cloud Image Supply Chain
• Cloud-Native Serverless Function Compromised
• Confused Deputy Attack
• Github Action Compromised
• Backdoored Software Supply Chain
• Cloud Application Compromised
• Exposed Cloud Credentials via Unauthenticated Kubernetes Dashboard

Pivot & Escalate (13)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Credentials Exposed in Storage Bucket
• Instance Takeover via User Data
• Kubernetes Service Account PrivEsc
• Instance Metadata Service (IMDS) Access
• Credential Store Compromise
• Identity and Access Management (IAM) Policy Abuse

C2 / Exfiltration (9)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Living Off the Cloud as Exfil
• Snapshotting Resources as Exfil
• Software as a Service (SaaS) Tunneling Virtual Private Network (VPN) as C2

Persistence (13)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Backdoored Container Image
• Additional Credential Creation
• Cloned Kubernetes Credentials
• Backdoored Role Trust Policy

Procedure (18)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Application Runtime Analysis
• Cloud Security Information and Event Management (SIEM) Log Analysis
• Cloud Identity and Entitlement Management (CIEM)
• Workload Protection
• Software Bill of Materials (SBOM) Analysis

Inject (15)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Undocumented Application Programming Interfaces (API)
• Attacker Stops Cloud Logging
• Cloud Security Training
• Instance Metadata Service Version 2 (IMDSv2) Project Complete
• Supply Chain Firewall
• Public Storage Bucket Exposed
• Exposed Sofware as a Service (SaaS) Application Programming Interface (API) Key During Public Presentation
• Third-Party Code Library Compromised

Huntress 85 cards

Huntress sponsor expansion.

Initial Compromise (14)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Exchange Zero-Day Vunlerability Exploit
• Fake Software Updates
• Embedded Remote Access Trojan (RAT)
• Public Facing Database Compromise

Pivot & Escalate (9)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Malware Propagation
• Unpatched Critical Security Update

C2 / Exfiltration (8)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Clipboard Scrape
• Rotating C2 Server Location

Persistence (13)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Living Off The Land
• Hiding in Plain Sight
• Registry Modification
• WMI Events

Procedure (14)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Call a Consultant

Inject (21)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Security Awareness Training for the Win!
• Ignore Those Pesky Open Ports
• A Bad Day Made Worse
• Haste Makes Waste
• Alert Fatigue is Real
• Knowledge is Power
• That Was a Bad Idea
• Read to The End
• Back to Basics
• Rookie Mistake
• A Little Help From My Friends
• Risk Accepted
• Major Failure Alert
• Let's Rock

Consultant (6)

• Kyle Hanslovan
• John Hammond
• Matthew Brennan
• Jamie Levy
• Harlan Carvey
• Cat Contillo

Red Canary 85 cards

Red Canary sponsor expansion.

Initial Compromise (15)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• USB Drive-By
• Compiled After Delivery
• Gatekeeper Bypass
• Obfuscated Payload Delivery
• RFID Thief

Pivot & Escalate (14)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Disabling Windows Defender
• Process Injection
• LSASS Credential Dump
• Application Control Bypass
• Read/Write With chmod 777
• PsExec Abuse
• Lateral Tool Transfer

C2 / Exfiltration (10)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Authorized Remote Tools
• Cloud Services as Exfil
• Bluetooth as Exfil
• Malicious Access Point

Persistence (13)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Event-Triggered Execution
• Scheduled Task
• Rename Process
• Spawn Web Shell

Procedure (15)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Call a Consultant
• Physical Security Review

Inject (15)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Missed Payday
• Not a Red Team
• Deez Registry Keyz Plz?
• Nuclear Test Site
• Quishing
• Cat on Keyboard Deletes Production Database
• Undocumented System
• Sneaky Sneaky RAT

Consultant (3)

• Adam Mashinchi
• Carrie Roberts
• Mike Haag

DenSecure 85 cards

DenSecure sponsor expansion.

Initial Compromise (17)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Microsoft Direct Phishing
• Wi-Fi Guest Network Escape
• Publicly Exposed Secret Key
• Vendor Default Credentials Attack
• Vishing
• Trojan Mail
• HTML Smuggling

Pivot & Escalate (14)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Insecure Internet of Things (IoT)
• Misconfigured Certificate Template
• NTLM Abuse
• Dumping LSASS Via Task Manager
• Default Administrator Credentials
• Decrypting LSA Secrets
• SUID Permissions Abuse

C2 / Exfiltration (10)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Unauthorized Filesharing Utility
• Misuse of Remote Access Software
• Hosted Note Taking as C2
• Bluetooth as Exfil

Persistence (14)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• MachineAccountQuota (MAQ) Abuse
• Group Policy Object (GPO) Modification
• Golden Ticket Attack
• Screensaver Hijack
• SSH Authorized Keys Modification

Procedure (15)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Cloud Event Log Analysis
• Permissions Audit

Inject (15)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Crank Up the Pressure
• Communication Infrastucture DDoS
• Way to Plan Ahead
• Water, Water Everywhere!
• Timber!
• It's a Feature, not a Bug
• Dude...Where's My Server?
• Executive Buy-In

Trimarc 86 cards

Trimarc sponsor expansion.

Initial Compromise (17)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Forest Trusts
• AI Generated Script
• SSO Provider Compromise
• Weaponized Hardware Security
• Compromised Virtual Host
• Corrupted Employee
• Malicious Extension

Pivot & Escalate (14)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Golden Ticket Attack
• Misconfigured Certificate Templates (ESC1)
• Overprivileged Group Policy/High Profile GPO
• Passwords in AD Attribute
• Overprivileged Cloud Application
• vCenter Console Coercion
• Server Management Compromise

C2 / Exfiltration (8)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• GIFs as C2
• Living Off Trusted Sites (LOTS)

Persistence (11)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• AdminSDHolder Rights Modification
• Cloud Application Impersonation

Procedure (16)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Cloud Event Log Analysis
• Permissions Audit
• Call a Consultant

Inject (15)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Bear vs. Powerstation
• Ghsoted by AI
• DiscountConsultant.lol
• Trimarc123!
• Dude, Where's Our Docs?
• Click, Click, Boom
• Peekaboo
• Product Trials and Tribulation

Consultant (5)

• Jake Hildreth
• Dev Badlu
• Sean Metcalf
• Brandon Colley
• SEANbot

Electrical Co-Op 83 cards

Energy-sector / NRECA deck.

Initial Compromise (17)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Wardriving
• Compromised Advanced Metering Infrastructure (AMI)
• Malicious QR Code
• Stolen Corporate Laptop
• Burglarized Rural Substations
• Imposter IT Worker
• Post End-Of-Life Exploitation

Pivot & Escalate (10)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• Account Abuse
• User Token Theft
• Trusted Connection Abuse

C2 / Exfiltration (6)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2

Persistence (17)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Remote Management Misuse
• Hardware Compromise
• Supervisory Control and Data Acquisition (SCADA) Breach
• Data Historian Compromise
• Shadow IT Compromise
• Tool Masquerade
• Vendor Account Misuse
• Temporary Permanence

Procedure (15)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Call a Consultant
• Protocol Analysis

Inject (16)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• Storm Duty
• Panic in The Streets
• Coordinated Campaign
• A Seat at The Table
• Watch Out Below
• Chuckles I Am In Danger
• Meth House Meltdown
• Wipe Better
• Business Email Compromise

Consultant (2)

• Cyber Mutual Assistance (CMA)
• Morale Suppression Team

The MEGA Deck 345 cards

Every deck merged into one huge deck.

Initial Compromise (59)

• Phishing
• Compromised Web Server
• Unauthorized Cloud Access
• Insider Threat
• External Password Spray
• Compromised Trusted Relationship
• Social Engineering
• Bring Your Own (Exploited) Device
• Exploited External Service
• Credential Stuffing
• Missing HTTP Strict Transport Security (HSTS) Protection
• Vendor Portal
• Dual-Homed Device
• Exchange Zero-Day Vunlerability Exploit
• Supply Chain Attack
• Fake Software Updates
• Infected Authorized Vendor Laptop
• Microsoft Direct Phishing
• Physical Access
• USB Drive-By
• Cloud Service Password Spray
• Compiled After Delivery
• Data Historian Compromise
• Embedded Remote Access Trojan (RAT)
• Forest Trusts
• Wi-Fi Guest Network Escape
• AI Generated Script
• Cloud Service Provider Vulnerability
• Gatekeeper Bypass
• IT Compromised With Shared Domain Trust
• Public Facing Database Compromise
• Publicly Exposed Secret Key
• Credentials Posted Publicly in a Code Repository
• Dirty USB
• Obfuscated Payload Delivery
• SSO Provider Compromise
• Vendor Default Credentials Attack
• Compromised Single Sign-On (SSO) Federated Identity
• Exploitable API
• Malicious OAuth Applciation
• Poisoned Cloud Image Supply Chain
• RFID Thief
• Vishing
• Weaponized Hardware Security
• Cloud-Native Serverless Function Compromised
• Compromised Virtual Host
• Insider Threat
• Misconfigured MFA
• Trojan Mail
• Confused Deputy Attack
• Corrupted Employee
• HTML Smuggling
• Public Storage Bucket Exposed
• Malicious Extension
• Github Action Compromised
• Out-of-Band Phish
• Backdoored Software Supply Chain
• Cloud Application Compromised
• Exposed Cloud Credentials via Unauthenticated Kubernetes Dashboard

Pivot & Escalate (57)

• Internal Password Spray
• Kerberoasting
• Broadcast/Multicast Protocol Poisoning
• Weaponizing Active Directory
• Credential Harvesting
• New Service Creation/Modification
• Local Pivilege Escalation (LPE)
• SMB Weakness
• Internal Spearphishing
• Access Token Manipulation
• Malware Propagation
• Stale Network Address Configurations (SNAC) Attack
• Unpatched Critical Security Update
• Cleartext Passwords in Files
• Disabling Windows Defender
• Malicious Project Files
• Process Injection
• EWS Issues Rogue Command
• Insecure Internet of Things (IoT)
• LSASS Credential Dump
• Application Control Bypass
• Golden Ticket Attack
• Misconfigured Certificate Template
• Modifying Read/Write Scripts
• Internal Password Spray
• Misconfigured Certificate Templates (ESC1)
• NTLM Abuse
• Read/Write With chmod 777
• Broadcast/Multicast Protocol Poisoning
• Dumping LSASS Via Task Manager
• Overprivileged Group Policy/High Profile GPO
• PsExec Abuse
• Credentials Exposed in Storage Bucket
• Default Administrator Credentials
• Lateral Tool Transfer
• New Service Creation/Modification
• Passwords in AD Attribute
• Decrypting LSA Secrets
• Instance Takeover via User Data
• Local Privilege Escalation
• Overprivileged Cloud Application
• GPO Push of Scheduled Tasks
• Kubernetes Service Account PrivEsc
• SUID Permissions Abuse
• vCenter Console Coercion
• Instance Metadata Service (IMDS) Access
• Server Management Compromise
• Credential Store Compromise
• Identity and Access Management (IAM) Policy Abuse
• Query of Cloud APIs
• Credentials Exposed in Environment Variables
• Credential Store Compromise
• Instance Metadata Service Access
• Malicious File Upload to Shared File Service
• Identity and Acess Management (IAM) Policy Abuse
• Misconfigured Container Image Compromise
• Search and Pillage Emails

C2 / Exfiltration (31)

• HTTP as Exfil
• HTTPS as Exfil
• Domain Name System (DNS) as C2
• Background Intelligent Transfer Service Bits (BITS) as Exfil
• Cloud-Based Services as Exfil
• Domaining Fronting as C2
• Create Inbox Rules to Forward Emails
• Malicious Serverless Function
• Virtual Machine Access via Web Portal
• Clipboard Scrape
• Rotating C2 Server Location
• Exfiltration Over Physical Medium
• Authorized Remote Tools
• Cloud Services as Exfil
• Bluetooth as Exfil
• GIFs as C2
• Malicious Access Point
• Living Off Trusted Sites (LOTS)
• Unauthorized Filesharing Utility
• Misuse of Remote Access Software
• Hosted Note Taking as C2
• Living Off the Cloud as Exfil
• Bluetooth as Exfil
• Snapshotting Resources as Exfil
• Screenshot Exfil
• Software as a Service (SaaS) Tunneling Virtual Private Network (VPN) as C2
• Bridged System
• Exfiltration Over Physical Medium
• HTTP as Exfil
• TCP Handshake as Morse Code
• DNS as C2

Persistence (46)

• Malicious Service
• Dynamic Link Library (DLL) Hijacking
• Malicious Driver
• New User Added
• Application Shiming
• Malicious Browser Plugins
• Logon Scripts
• Malicious Firmware
• Accessibility Features
• Living Off The Land
• Event Triggered Malware
• Hiding in Plain Sight
• Malware Injection Into Client Software
• Registry Modification
• Malicious Email Rules
• WMI Events
• Windows Service Recovery Actions
• Registry Keys for Persistence
• MachineAccountQuota (MAQ) Abuse
• Stolen Engineering Workstation (EWS) Account
• Group Policy Object (GPO) Modification
• Malicious Logon Scripts
• Event-Triggered Execution
• Golden Ticket Attack
• GPO Modification
• AdminSDHolder Rights Modification
• Backdoored Container Image
• Malicious Report Macros
• Scheduled Task
• Screensaver Hijack
• Additional Credential Creation
• Cloud Application Impersonation
• HMI Graphics Manipulation
• Rename Process
• SSH Authorized Keys Modification
• Cloned Kubernetes Credentials
• Malicious Firmware
• Spawn Web Shell
• Autorun Malware
• Backdoored Role Trust Policy
• New User Added
• Accessibility Features
• Backdoored Container Image
• Cross-Tenant Access
• MFA Bypass: App Password Creation
• Secondary Access Key Creation

Procedure (42)

• Server Analysis
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Analysis
• Network Threat Hunting
• Active Defense and Cyber Deception
• Endpoint Security Protection Analysis
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Isolation
• Crisis Management
• Memory Analysis
• Cloud Event Log Analysis
• Permissions Audit
• Call a Consultant
• Call a Consultant
• Cloud Event Log Analysis
• Cloud Event Log Analysis
• Application Runtime Analysis
• Permissions Audit
• Permissions Audit
• Physical Security Review
• Call a Consultant
• Cloud Security Information and Event Management (SIEM) Log Analysis
• Cloud Identity and Entitlement Management (CIEM)
• Workload Protection
• Software Bill of Materials (SBOM) Analysis
• Call a Consultant
• Physical Security Review
• Sequence of Events (SOE) Analysis
• Cloud Event Log Analysis
• Protocol Analysis
• Cyber Deception
• Permissions Audit
• Site Walkthrough
• Shodan Review
• Security Information and Event Management (SIEM) Log Analysis
• Firewall Log Review
• Consequence-Driven Threat Hunting
• Employee Interviews
• User and Entity Behavior Analytics (UEBA)
• Endpoint Analysis
• Memory Analysis

Inject (82)

• False Alarm: It Was a Penetration Test
• Data Uploaded to Pastebin
• Analyst Returns from Incident Response Training
• Policy? What Policy?
• Luck of The SOC
• Bobby the Intern Kills the System You are Reviewing
• Legal takes Your Most Skilled Handler into a Meeting to Explain the Incident
• AI Hacked Into Your Cloud Accounts
• Cloud Provider Disabled Vulnerable Functionality
• Cloud Bill Due
• Security Awareness Training for the Win!
• Cloud Security Training
• Ignore Those Pesky Open Ports
• A Bad Day Made Worse
• Cryptominer
• Dangling Domains
• Haste Makes Waste
• Alert Fatigue is Real
• Exposed Cloud Access Keys During Public Presentation
• Food Poisoning
• I'm Not the Cloud Person
• Knowledge is Power
• SIEM Goes Down
• Regional Cloud Provider Data Center Outage
• That Was a Bad Idea
• This Isn't the First Time, and Won't Be the Last
• EDR Compromise
• Read to The End
• Third-Party Code Library Compromised
• Attackers Taunt You
• Back to Basics
• Attackers Timestomp Key Evidence Files
• Bear vs. Powerstation
• Rookie Mistake
• A Little Help From My Friends
• Ghsoted by AI
• Missed Payday
• No Good Deed Goes Unpunished...
• DiscountConsultant.lol
• Not a Red Team
• Our Friend, Hacky
• Risk Accepted
• Deez Registry Keyz Plz?
• Is it Getting Hot in Here?
• Major Failure Alert
• Trimarc123!
• Crank Up the Pressure
• Don't Forget to Smash the Subscribe Button!
• Dude, Where's Our Docs?
• Let's Rock
• Nuclear Test Site
• Click, Click, Boom
• Communication Infrastucture DDoS
• Quishing
• Undocumented Application Programming Interfaces (API)
• Attacker Stops Cloud Logging
• Cat on Keyboard Deletes Production Database
• Peekaboo
• Way to Plan Ahead
• Cloud Security Training
• Product Trials and Tribulation
• Undocumented System
• Water, Water Everywhere!
• Instance Metadata Service Version 2 (IMDSv2) Project Complete
• Sneaky Sneaky RAT
• Timber!
• It's a Feature, not a Bug
• Supply Chain Firewall
• Dude...Where's My Server?
• Public Storage Bucket Exposed
• Executive Buy-In
• Exposed Sofware as a Service (SaaS) Application Programming Interface (API) Key During Public Presentation
• Third-Party Code Library Compromised
• Unexpected PLC State Change
• Safety Instrumented System (SIS) Tampering
• Mediation
• You Can't Get There From Here
• Emergency Facility Shutdown
• Legacy Knowledge
• No High Availability (HA) System
• No Shirt, No Shoes...
• USB Worm

Consultant (28)

• Alethe Denis
• Kyle Hanslovan
• John Hammond
• Time Medin
• Jorge Orchilles
• Matthew Brennan
• Alissa Torres
• Jake Hildreth
• Jamie Levy
• Adam Mashinchi
• Dev Badlu
• Dieter Smith
• Harlan Carvey
• Carrie Roberts
• Cat Contillo
• Marcus J. Carey
• Sean Metcalf
• Brandon Colley
• Mike Haag
• Robert M. Lee
• Chloe Messdaghi
• SEANbot
• Eric Conrad
• John Strand
• Joff Thyer
• Beau Bullock
• Richard Phung
• Edward Miro