Why Offense in Depth is Vital to Red Team Operations

With rising macOS threats, many security controls fail. Learn how to validate your detective controls and close the Mac detection gap to mitigate business risk.

NetSPI research found nearly 60% of common attack tactics slip past endpoint tools with default settings. Its BAS as a Service blends expert-led testing with platform data to validate detection.

Breach and attack simulation validates detective controls by mimicking real threats; NetSPI data shows 80 percent of common attack behaviors evade out-of-the-box EDR, SIEM, and MSSP detection.

Explores the promise and shortcomings of MITRE ATT&CK Evaluations for judging EDR products, warning that vendors' 100 percent claims can mislead and SOCs need a data-driven detection landscape view.

Will Pearce demonstrates machine learning for red teams: a simple process list provides enough data to detect sandbox environments, helping payloads avoid detonation and extend technique lifespan.

Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.