BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Hiding Infrastructure in Plain Sight\n   Tags: Adver
 sary Village | Creator Talk/Panel\n   When: Saturday\, Aug 8\, 13:00 - 13:
 25 PDT\n   Where: LVCCW Level 1 Hall 2 602 (Adversary Village) Hands-on Ac
 tivity\n   Area - [1]Map\n\n   Description:\n\n   When performing adversar
 y emulation for training SOC analysts\,\n   incident responders and threat
  hunters\, tools are employed within a\n   platform to monitor the status 
 of the attack flow and participant\n   behaviors. For example\, training p
 roviders or in-house training\n   platforms may use computer based agents 
 to perform activity to\n   simulate users authenticating to a host\, openi
 ng files\, browsing the\n   web\, uploading and downloading files\, monito
 ring 'flags' to determine\n   if they were detected and removed\, or an in
 structor may be watching\n   user's as they participate via a remote acces
 s program.\n\n   When it is time for the participants to engage in investi
 gating the\n   attack\, they may encounter the applications that are used 
 to perform\n   the infrastructure tasks\, such as the simulated computer u
 se. That\n   could potentially confuse the participant or cause them to go
  down\n   rabbit holes investigating the infrastructure backend processes 
 and\n   not the intended processes that are part of the emulation. For\n  
  instance\, if they see a tool like Veyon\, or TacticalRMM\, they could\n 
   confuse that for the attacker's tools. Rather\, those could be the\n   i
 nstructor or host monitoring their activity (Veyon) or the tool used\n   t
 o manage the dozens of VMs that may be employed (TacticalRMM) for the\n   
 learning and training platform.\n\n   One method to mitigate this issue is
  to have a list of what to ignore\n   and the participants have to keep ch
 ecking that list\, if they\n   remember.\n\n   I am proposing the use of "
 Phantom Infra." An eBPF program I created\n   to hide infrastructure tasks
  and processes so users can focus on\n   capturing the flags and honing th
 eir threat hunting skills and not\n   chase rabbit holes or become confuse
 d by infrastructure processes.\n   This allows adversary emulation activit
 ies to run with many\n   distractions and allows the creators of the simul
 ation to perform\n   activities on the host to prepare and stage files for
  a successful\n   simulation.\n\n   This is useful and targeted for traini
 ng purposes and for education\n   based adversary emulation exercises or C
 TF events where users are\n   actively logged into an OS and performing ac
 tivities to learn and hunt\n   for adversary TTPs.\n\n   SpeakerBio:  Duan
 e Dunston\, Cybersecurity Training for Everyone\n\n   Dr. Duane Dunston\, 
 EdD was a Senior Adversarial Engineer at Cloud\n   Range where he created 
 cyberattacks within a live range and trained\n   corporate cybersecurity t
 eams to identify and respond to the attacks.\n   Duane was previously an A
 ssociate Professor of Cybersecurity at\n   Champlain College from 2012 - 2
 022. He has been in Information\n   Security since 1997 working in the edu
 cation\, government\, and private\n   sectors. He focuses on risk manageme
 nt\, red and blue team training\n   development\, security education\, thr
 eat intelligence\, threat hunting\,\n   and using technology for social ch
 ange.\n\n   Links:\n       adversaryvillage.org/adversary-events/DEFCON-34
 /Duane-Dunston/ -\n   [2]https://adversaryvillage.org/adversary-events/DEF
 CON-34/Duane-Dunston/\n   '\n\n   1. #LVCCW_Level1_Hall2\n   2. https://ad
 versaryvillage.org/adversary-events/DEFCON-34/Duane-Dunston/\n\n\n
DTEND:20260808T202500Z
DTSTART:20260808T200000Z
LOCATION:Adversary Village - LVCCW Level 1 Hall 2 602 (Adversary Village) H
 ands-on Activity Area
SUMMARY:Hiding Infrastructure in Plain Sight
END:VEVENT
END:VCALENDAR