TROOPERS23: Forensic analysis on real incidents inside Microsoft Remote Desktop Services

Talk by Catarina de Faria Cristas - June 29th, 2023 at TROOPERS23 IT security conference in Heidelberg, Germany hosted by @ERNW_ITSec
#TROOPERS23 #ITsecurity
troopers.de/troopers23/talks/...
More impressions:
/ wearetroopers
/ ernw_itsec
infosec.exchange/@WEareTROOPERS
infosec.exchange/@ERNW
ernw.de

[@materaj]

0:39 Whoami 3:59 Microsoft Remote Desktop Services (RDS) Roles 6:47 How to compromised and investigate a RDS infrastructure (Gaining an initial foothold) 21:08 How to compromised and investigate a RDS infrastructure (Breaking out of RDS) 28:04 How to compromised and investigate a RDS infrastructure (Additional compromise) 28:59 How to compromised and investigate a RDS infrastructure (Additional compromise - Demo) 32:27 How to compromised and investigate a RDS infrastructure (Real World Attack Case#1) 35:46 How to compromised and investigate a RDS infrastructure (Real World Attack Case#2) 38:34 How to compromised and investigate a RDS infrastructure (Recommendation)