BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Sold Out - Investigating and Responding to M365 acco
 unt\n   compromise on a shoestring: Living of the Land Incident Response\n
    Tags: DEF CON Workshop | DEF CON Workshops\n   When: Friday\, Aug 7\, 1
 4:00 - 17:59 PDT\n   Where: LVCCW Level 2 W222 (Workshops) - [1]Map\n\n   
 Description:\n\n   A compromised mailbox. An inbox rule named ".". An OAut
 h consent to an\n   unknown application. A sign-in from a cloud-hosting AS
 N with\n   user-agent "axios" and MFA status "satisfied by claim in token"
 .\n   Somewhere in there is the story - and somewhere in the Microsoft 365
 \n   logs is the evidence. This four-hour hands-on workshop teaches\n   Bu
 siness Email Compromise investigation in the tenants most responders\n   a
 ctually see: M365 Business Premium or E3. No Sentinel. No SIEM. No\n   pro
 blem. Using only native admin centers\, PowerShell modules\, and a\n   few
  scripts\, you will run a complete BEC investigation end to end.\n   Worki
 ng through several progressive scenarios\, from single-user\n   compromise
 \, through lateral-pivot case with MailItemsAccessed\n   analysis\, to mul
 ti-account incident with a malicious enterprise app\n   and transport rule
 . You will learn how to contain\, collect\, triage\,\n   pivot\, expand sc
 ope\, remediate\, and produce the three common reporting\n   deliverables:
  investigation report\, attestation letter\, internal\n   post-mortem. Thi
 s is Living off the Land Incident Response. Through\n   chronology and top
 ology\, come correlate some logs with me and see what\n   story they tell.
 \n\n   SpeakerBio:  Vince "bitpusher" Weppner\n\n   Vincent M. Weppner (Bi
 tpusher) is an Information Security Specialist\n   with 10+ years of dedic
 ated cybersecurity focus and 25 years in IT\n   overall. He works as a Sec
 urity Analyst at a mid-market MSP and runs\n   an independent IT consultin
 g practice at theTechRelay.com. Generally\n   found lurking in the mountai
 ns of Southern California\, and\n   occasionally maintaining his open-sour
 ce tooling at\n   github.com/bitpusher2k. His day-to-day work covers M365 
 security\n   operations\, Active Directory and endpoint security\, BEC/ran
 somware\n   incident response\, EDR/SIEM management\, and security consult
 ing for\n   SMB and mid-market clients. Specialization in Business Email\n
    Compromise was built out of direct operational need: after dozens of\n 
   BEC incidents\, the pattern of "which script do I need to run right\n   
 now?" became clear enough to codify. Passionately solving puzzles\n   thro
 ugh scripting\, and hoping to pass on some of it to you.\n\n   Links:\n   
     Registration (July 14\, 2026\, Noon US Pacific) - [2]https://events.hu
 manitix.com/fri_pm_ws8_4033\n   '\n\n   1. #LVCCW_Level2_North\n   2. http
 s://events.humanitix.com/fri_pm_ws8_4033\n\n\n
DTEND:20260808T005900Z
DTSTART:20260807T210000Z
LOCATION:DEF CON Workshops - LVCCW Level 2 W222 (Workshops)
SUMMARY:Sold Out - Investigating and Responding to M365 account compromise 
 on a shoestring: Living of the Land Incident Response
END:VEVENT
END:VCALENDAR