BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsidesaugusta2023//speaker//GBW7AR
BEGIN:VTIMEZONE
TZID:US/Eastern
BEGIN:DAYLIGHT
DTSTART:20221007T000000
TZNAME:EDT
TZOFFSETFROM:-0400
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20221106T020000
RDATE:20231105T020000
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20230312T030000
RDATE:20240310T030000
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Meet Your Nemesis: Fighting Data With Data - Will Schroeder\, Maxw
 ell Harley
DTSTART;TZID=US/Eastern:20231007T123000
DTEND;TZID=US/Eastern:20231007T133000
DTSTAMP:20261012T024531Z
UID:pretalx-bsidesaugusta2023-MDJ7PV@pretalx.com
DESCRIPTION:The offensive industry is about exploring what’s possible. P
 art of this is observing and taking lessons from other disciplines that ha
 ve already solved a myriad of related challenges\, from proper software en
 gineering practices to using graph theory for offensive problems. But desp
 ite various leaps forward over the last several years\, the offensive post
 -exploitation community has yet to fully embrace data analysis and enrichm
 ent pipelines beyond basic log aggregation and searching. If offensive too
 ls were structured for automated processing instead of solely human consum
 ption\, we could unify post-ex data to exploit the known (and unknown) rel
 ationships within the data our offensive tools emit.\n\nImagine a system t
 hat could ingest data from any C2 framework or post-ex tool\, and could no
 t just automate common operator tasks like binary analysis for known vulne
 rabilities and hash extraction and cracking of encrypted documents\, but c
 ould perform complex offline analysis like host privilege escalation. If w
 e could unify all post-exploitation data from offensive engagements we cou
 ld improve operator workflows\, provide tradecraft assistance\, facilitate
  automation of onerous tasks\, and uncover new data-driven research opport
 unities. A year ago\, our team embarked on the development of just such a 
 system\, and we are excited to introduce the result of our effort: Nemesis
 .\n\nThis presentation will start by detailing the various red team challe
 nges regarding data\, leading into how this influenced Nemesis’ architec
 tural decisions and design. Along the way we’ll cover various time-savin
 g automations Nemesis can perform along with offensive data enrichments an
 d analytics the engine can produce. This is the start of a true universal 
 operator assistance platform\, with operator guidance contextualized by da
 ta as it comes into command and control platforms. Beyond this\, Nemesis w
 ill enable the emerging discipline of offensive data analysis\, which we h
 ope will unlock possibilities we can’t even imagine.
LOCATION:Track 3
URL:https://pretalx.com/bsidesaugusta2023/talk/MDJ7PV/
END:VEVENT
END:VCALENDAR