Skip to main content
Badar Mehmood

Badar Mehmood

Senior Cybersecurity Engineer
Neomtech
Senior Cybersecurity Engineer and Offensive Security Consultant with over 10 years of IT experience, including 7+ years specializing in offensive security, penetration testing, Red Team operations, and application security. Experienced in Web, Mobile, API, Network, Active Directory, Cloud, and DevSecOps security assessments for financial, government, healthcare, and critical infrastructure sectors across the GCC. Skilled in VAPT, adversary simulation, source code reviews, and security architecture assessments aligned with PCI DSS, SAMA CSF, NCA ECC, and SWIFT CSP. Holds multiple industry certifications, including OSCP+, CRTP, eCPPT, CASA, CAP, CEH Practical, and AWS Solutions Architect Associate.

Speaker sessions

Briefings and Arsenals | Confirmed Speakers | No Session Assigned

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
  • 07:30
  • Tue
  • 01 Dec
Stage: Briefing Stage 2
Sessions Type: Keynote

When LSASS Won't Dump: Red Teaming Active Directory Under RunAsPPL, WDAC, and Patched noPac

Most Active Directory attack playbooks assume LSASS memory dumping, unrestricted living-off-the-land binaries, and an unpatched noPac are still viable. In mature, defensively hardened enterprise environments, none of them are. This session is built from real multi-session red team engagements against segmented Active Directory domains protected by RunAsPPL level 2 with UEFI lock, Windows Defender Application Control (WDAC), and patched privilege-escalation paths, and walks through what still works when the standard toolkit is blocked at every turn.The session covers: recovering credential material through Volume Shadow Copy-based SAM/SYSTEM/SECURITY hive extraction once LSASS memory access is locked down; weaponizing NTLM relay opportunities with Responder and ntlmrelayx inside segmented networks; using BloodHound-driven attack path analysis to validate DCSync feasibility before attempting domain compromise rather than guessing; falling back on Kerberoasting and ASREPRoasting when in-memory techniques are unavailable; adapting post-exploitation and lateral movement when WDAC blocks common LOLBins; and pivoting into segmented network zones through MSSQL trust relationships.The session closes with a reporting methodology often missing from offensive security talks: documenting positive controls alongside findings, so defenders receive credit for what is genuinely stopping the attack chain, along with a precise picture of the remaining gap. Attendees will leave with a concrete, field-tested toolkit for operating against genuinely hardened Active Directory environments, and a framework for communicating results that strengthens the relationship between red and blue teams rather than just producing a list of findings.
  • 17:30
  • Wed
  • 02 Dec
Stage: Briefing Stage 1
Sessions Type: Keynote