BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Maestro\n   When: Saturday\, Aug 10\, 10:00 - 11:45 
 PDT\n   Where: LVCC West/Floor 3/W303 - [1]Map\n\n   Description:\n\n   Ma
 estro is a post-exploitation tool designed to interact with\n   Intune/Ent
 raID from a C2 agent on a user's workstation without\n   requiring knowled
 ge of the user's password or Azure authentication\n   flows\, token manipu
 lation\, and web-based administration console.\n   Maestro makes interacti
 ng with Intune and EntraID from C2 much easier\,\n   as the operator does 
 not need to obtain the user's cleartext password\,\n   extract primary ref
 resh token (PRT) cookies from the system\, run\n   additional tools or a b
 rowser session over a SOCKS proxy\, or deal with\n   Azure authentication 
 flows\, tokens\, or conditional access policies in\n   order to execute ac
 tions in Azure on behalf of the logged-in user.\n   Maestro enables attack
  paths between on-prem and Azure. For example\,\n   by running Maestro on 
 an Intune admin's machine\, you can execute\n   PowerShell scripts on any 
 enrolled device without ever knowing the\n   admin's credentials!\n\n   Sp
 eakerBio:  Chris Thompson\, Principal Consultant at SpecterOps\n\n   Chris
  Thompson (@_Mayyhem) is a Principal Consultant at SpecterOps\,\n   where 
 he conducts red team operations\, research\, tool development\, and\n   tr
 aining. Chris has instructed at Black Hat USA/EU and spoken at\n   Arsenal
 \, DEF CON Demo Labs\, SO-CON\, and Troopers. He is the primary\n   author
  of Maestro and SharpSCCM and co-author of Misconfiguration\n   Manager\, 
 an open-source tool and knowledge base that can be used to\n   help demons
 trate\, mitigate\, and detect attacks that abuse Microsoft\n   Configurati
 on Manager (formerly SCCM).\n\n   '\n\n   1. #LVCCW_Level3_South\n\n\n
DTEND:20240810T184500Z
DTSTART:20240810T170000Z
LOCATION:DL - LVCC West/Floor 3/W303
SUMMARY:Maestro
END:VEVENT
END:VCALENDAR