BEGIN:VCALENDAR
PRODID:-//vBulletin 6//EN
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VEVENT
UID:8a644e1d-a6cb-4bf0-8489-e3a906586047
DTSTAMP:20260426T172108Z
SUMMARY:Maestro : Chris Thompson :
DESCRIPTION:Title: Maestro\nPresenter: Chris Thompson\nCo-Presenter:\nLocat
 ion: W303\nDay\,Time: Sat Aug 10 \, 10AM - 11:45AM\nAudience: Offense\, Cl
 oud\nProject: https://github.com/Mayyhem/Maestro\n\nAbstract:\nMaestro is 
 a post-exploitation tool designed to interact with Intune/EntraID from a C
 2 agent on a user's workstation without requiring knowledge of the user's 
 password or Azure authentication flows\, token manipulation\, and web-base
 d administration console. Maestro makes interacting with Intune and EntraI
 D from C2 much easier\, as the operator does not need to obtain the user's
  cleartext password\, extract primary refresh token (PRT) cookies from the
  system\, run additional tools or a browser session over a SOCKS proxy\, o
 r deal with Azure authentication flows\, tokens\, or conditional access po
 licies in order to execute actions in Azure on behalf of the logged-in use
 r. Maestro enables attack paths between on-prem and Azure. For example\, b
 y running Maestro on an Intune admin's machine\, you can execute PowerShel
 l scripts on any enrolled device without ever knowing the admin's credenti
 als!\n\nBios:\n* Presenter:\nChris Thompson (@_Mayyhem) is a Principal Con
 sultant at SpecterOps\, where he conducts red team operations\, research\,
  tool development\, and training. Chris has instructed at Black Hat USA/EU
  and spoken at Arsenal\, DEF CON Demo Labs\, SO-CON\, and Troopers. He is 
 the primary author of Maestro and SharpSCCM and co-author of Misconfigurat
 ion Manager\, an open-source tool and knowledge base that can be used to h
 elp demonstrate\, mitigate\, and detect attacks that abuse Microsoft Confi
 guration Manager (formerly SCCM).\n* Co-Presenter:
URL:https://forum.defcon.org/node/249621
DTSTART:20240810T180000Z
DTEND:20240810T194501Z
LOCATION:W303
END:VEVENT
END:VCALENDAR